ResearchOpenAI

OpenAI increases security bug bounty rewards

Original title: Rewarding defenders with bigger bug bounties

Plain language

What it is: OpenAI is increasing the cash rewards for independent security researchers who find and report security flaws in its software. They are also adding new bonuses for high-quality reports, loyal researchers, and testing new features.
How it works: The company is raising the average reward amounts for medium, high, and critical security issues. Researchers can earn extra bonuses by providing clear proof of the issue, submitting reports consistently, or testing newly launched features.
Where it is available: This applies to OpenAI's Security Bug Bounty program, which covers core products like ChatGPT, Codex, and the API Platform.
Example: A researcher who finds a way to take over a ChatGPT account with a single click can now earn a much higher reward, which can exceed 50,000 dollars with bonuses.

What it is: OpenAI has updated its Security Bug Bounty program by increasing base payouts and introducing new bonus multipliers. These multipliers reward report quality, researcher loyalty, and participation in priority campaigns.
How it works: Base rewards for medium, high, and critical vulnerabilities are quadrupled on average. Multipliers are applied for providing a reliable proof of concept, reaching tiers in a 5-tier loyalty program, or participating in short-term priority campaigns for new features.
Where it is available: The program applies to OpenAI software, including core assets like ChatGPT, Codex, and the API Platform, as well as non-core assets.
Example: A medium-severity bug where a read-only member can upload files to a Project without write permission in ChatGPT now receives a higher base payout plus quality and loyalty multipliers.

The headline and explanation on this page are based on OpenAI's post. The full details are in the original.

Rewarding defenders with bigger bug bounties