OpenAI has raised the money it pays outside researchers who find security holes in its products, a move that says as much about intent as about cash. Higher bounties are the clearest signal a company can send that it genuinely wants people probing its software, and OpenAI has more than quadrupled the midpoint of its reward ranges for medium, high and critical findings on average.
The headline numbers are worth laying out. A critical vulnerability in a core product such as ChatGPT, Codex or the API Platform, all of which we review, now pays up to $30,000. Exceptional critical findings remain eligible for a base of up to $100,000, but new bonus multipliers can lift a standout report well beyond that: OpenAI's own example of a zero-click account takeover reaches $51,577, and an attack letting someone read arbitrary users' chat messages reaches $171,925 once quality, priority and loyalty bonuses stack on the $100,000 base.
Those bonuses are the part that needs reading closely. A quality multiplier rewards a report that includes a reliable proof of concept isolating the bug and showing its impact, which saves the defending team time. A five-tier loyalty programme pays more to researchers who return, and short-term priority campaigns put extra money on newly launched features to draw attention where OpenAI most wants eyes. The structure encourages better reports, not just more of them, but it also means the eye-catching figure is a stack of conditions rather than a flat rate.
One detail is a genuinely fair touch. OpenAI says it will apply the new, higher ranges retroactively to reports already submitted but not yet awarded, and will pay the difference on bounties awarded in the 30 days before the announcement where the finding would have earned more. That treats recent contributors as well as future ones, which is not something every programme bothers to do.
The caveat is in the arithmetic. The top figure depends on several multipliers landing at once, so a researcher should read the tiers on the Bugcrowd page before assuming the $172,000 headline applies to their find. Raising payouts is the right lever to pull when a company wants more outside scrutiny of products that millions now rely on, but the real test is whether the higher rates actually bring in more and better reports over the next year, which is something only the vulnerability data will show.