OpenAI raises top bug bounty payout to $172,000 and adds quality bonuses and a loyalty program
OpenAI raised the rewards in its security bug bounty program to attract more independent vulnerability research. The midpoints of the reward ranges for medium, high and critical findings more than quadrupled on average. Critical flaws in core products such as ChatGPT, Codex and the API Platform can earn base bounties of up to $30,000. Exceptional critical findings remain eligible for base bounties of up to $100,000, with total payouts of up to $172,000 once bonuses are included. The program complements OpenAI's internal Defense Factory, where engineers use the company's models to find and reproduce vulnerabilities and test fixes.
Detalhes técnicos
- High-quality reports, in particular those with a reliable proof of concept, are eligible for a multiplier on the base bounty.
- OpenAI introduced a five-tier loyalty program, with larger bonuses at higher tiers.
- Short-term campaigns will have dedicated bonus pools for researchers who test newly launched features.
Remediação
This is a program change with no vulnerability to patch. Researchers who already submitted a report that has not yet been awarded will have the new reward ranges applied. For bounties awarded in the 30 days before the announcement, OpenAI will pay the difference if the finding would have earned more under the new ranges, counting base and loyalty awards.
Linha do tempo
-
OpenAI raises top bug bounty payout to $172,000 and adds quality bonuses and a loyalty program
ler a análise desta fonte ocultar
OpenAI raised the rewards in its security bug bounty program to attract more independent vulnerability research. The midpoints of the reward ranges for medium, high and critical findings more than quadrupled on average. Critical flaws in core products such as ChatGPT, Codex and the API Platform can earn base bounties of up to $30,000. Exceptional critical findings remain eligible for base bounties of up to $100,000, with total payouts of up to $172,000 once bonuses are included. The program complements OpenAI's internal Defense Factory, where engineers use the company's models to find and reproduce vulnerabilities and test fixes.
Technical Details
- High-quality reports, in particular those with a reliable proof of concept, are eligible for a multiplier on the base bounty.
- OpenAI introduced a five-tier loyalty program, with larger bonuses at higher tiers.
- Short-term campaigns will have dedicated bonus pools for researchers who test newly launched features.
Remediation
This is a program change with no vulnerability to patch. Researchers who already submitted a report that has not yet been awarded will have the new reward ranges applied. For bounties awarded in the 30 days before the announcement, OpenAI will pay the difference if the finding would have earned more under the new ranges, counting base and loyalty awards.