How much does the OpenAI bug bounty pay now?

OpenAI's Security Bug Bounty now pays more than four times its old rates for critical findings. Exceptional, critical reports can earn up to $172,000 when the new bonuses are included. The previous bonus-inclusive ceiling was $100,000, and the program started in April 2023 with a $20,000 maximum. Reports are submitted through Bugcrowd.

Do the new OpenAI bounty rates apply to reports I already sent?

Yes. OpenAI says the new reward ranges apply to reports that are still awaiting review. For eligible bounties it awarded in the previous 30 days, OpenAI will pay the difference between the old and new amounts. Researchers do not need to resubmit those reports to get the higher rates.

Does a ChatGPT jailbreak qualify for OpenAI's bug bounty?

Not on its own. OpenAI's program excludes simple jailbreaks that bypass content rules without a shown safety or abuse impact, rude outputs, and easily searchable public information. Findings about agentic abuse or platform integrity can qualify, but they must reproduce in at least 50% of attempts to reach the highest payouts, with documented steps and trial counts.

Who is Cathedral Systems and why is it working with OpenAI?

Cathedral Systems is a security startup founded in 2026 by former Department of Government Efficiency staffers. OpenAI named it as the partner for its next internal security sprint, where Cathedral researchers will use OpenAI models to test OpenAI's defenses. Cathedral earlier reached Anthropic's internal systems through third-party software during a bug bounty investigation; Anthropic disputes the extent and says it broke the rules.

OpenAI · 2026-11-02 · major

OpenAI bug bounties up to $172,000 — and Cathedral joins its security sprint

In short

OpenAI more than quadrupled its rewards for critical security bugs, with up to $172,000 for exceptional reports. Cathedral Systems researchers will use OpenAI models to attack OpenAI's defenses in its next internal security sprint.

OpenAI · 2026-11-02 · 3 sources checked

AlphaSignal card reading 'OpenAI Raises Bug Bounty to $172,000 to Hunt Its Own Flaws' on a black background — AlphaSignal

OpenAI pays outside hackers much more for serious bugs and brings in Cathedral to attack its own systems with AI.

Key specs

Top payout	$172,000
Previous ceiling	$100,000

Quick facts

Maker	OpenAI
Critical rewards	More than 4x higher
New bonuses	Report quality, loyalty, priority campaigns
Back pay	Pending reports + bounties paid in the last 30 days
Sprint partner	Cathedral Systems
Announced	2 November 2026

What is it?

OpenAI's Security Bug Bounty now pays more than four times as much for critical findings, and exceptional reports can earn up to $172,000 once bonuses are added. The program also adds bonuses for report quality, researcher loyalty and priority campaigns. In a second post the same day, OpenAI said its next internal security sprint will include Cathedral Systems, whose researchers will use OpenAI's models alongside OpenAI's own teams to challenge its defenses.

How does it work?

The higher ranges apply to new reports and to reports already waiting for review, and OpenAI pays the difference on eligible bounties awarded in the past 30 days, so researchers do not need to resubmit. Simple jailbreaks with no shown safety or abuse impact stay out of scope; agentic-risk findings must reproduce in at least half of attempts to get the top payouts. OpenAI has not said when the Cathedral sprint starts, what it targets or how much access Cathedral gets.

Why does it matter?

Models now find vulnerabilities faster, so OpenAI is paying defenders to use that ability on its systems before attackers do. The choice of partner is notable: Cathedral, founded in 2026 by former DOGE staffers, reached Anthropic's internal systems through third-party software during an earlier bug bounty investigation, and Anthropic later accused it of breaking the program's rules.

Who is it for?

security researchers, bug bounty hunters, teams running AI agents

Frequently asked questions

How much does the OpenAI bug bounty pay now?: OpenAI's Security Bug Bounty now pays more than four times its old rates for critical findings. Exceptional, critical reports can earn up to $172,000 when the new bonuses are included. The previous bonus-inclusive ceiling was $100,000, and the program started in April 2023 with a $20,000 maximum. Reports are submitted through Bugcrowd.
Do the new OpenAI bounty rates apply to reports I already sent?: Yes. OpenAI says the new reward ranges apply to reports that are still awaiting review. For eligible bounties it awarded in the previous 30 days, OpenAI will pay the difference between the old and new amounts. Researchers do not need to resubmit those reports to get the higher rates.
Does a ChatGPT jailbreak qualify for OpenAI's bug bounty?: Not on its own. OpenAI's program excludes simple jailbreaks that bypass content rules without a shown safety or abuse impact, rude outputs, and easily searchable public information. Findings about agentic abuse or platform integrity can qualify, but they must reproduce in at least 50% of attempts to reach the highest payouts, with documented steps and trial counts.
Who is Cathedral Systems and why is it working with OpenAI?: Cathedral Systems is a security startup founded in 2026 by former Department of Government Efficiency staffers. OpenAI named it as the partner for its next internal security sprint, where Cathedral researchers will use OpenAI models to test OpenAI's defenses. Cathedral earlier reached Anthropic's internal systems through third-party software during a bug bounty investigation; Anthropic disputes the extent and says it broke the rules.

Try it

Report through OpenAI's Security Bug Bounty program on Bugcrowd