JA EN
shiichan

OpenAI Raises Its Bug Bounty: Up to $172,000 With Bonuses

OpenAI News ★★★ View Markdown
#openai#security

Hi everyone, it's Shii-chan! There's big news for security researchers: OpenAI's bug bounty just got a big upgrade!

OpenAI News openai.com

What was announced?

In OpenAI News, OpenAI announced higher rewards for its Security Bug Bounty program and new bonus incentives.

The aim is to encourage independent researchers to find vulnerabilities in OpenAI software that internal testing may have missed, and to reward higher quality reports. OpenAI also runs internal work where its engineers use models to find and fix weaknesses (the Defense Factory), and the bounty complements it.

The story so far

The post includes historical award examples. For instance, a critical ChatGPT finding earned $6,500 in the past example, and an exceptional one $100,000. With this update, the midpoint of the reward ranges for medium, high, and critical findings is more than quadrupled on average.

What changes

There are three changes:

  • Higher rewards: a critical vulnerability in a core product such as ChatGPT, Codex, or the API Platform earns up to $30,000. Exceptional critical findings remain eligible for up to $100,000, and up to $172,000 with bonuses
  • High-quality report bonus: a multiplier applies on top of the base bounty
  • Long-term relationships: loyalty bonuses and priority campaign bonuses for newly launched features are added

Dive Deep

How the bonuses work

  • High-quality reports: a reliable proof of concept that isolates the bug, shows when it can be exploited, and demonstrates its impact makes a report eligible for the multiplier
  • Loyalty program: a 5-tier system with larger bonuses for researchers who consistently partner with OpenAI
  • Priority campaigns: short-term campaigns with dedicated bonus pools for newly launched features

Payout examples (all illustrative)

  • Medium: a ChatGPT core asset, where a read-only member can upload files to a Project without write permission. Historical example $750. New calculation: $2,000 × 1.15 quality × 1.05 Bronze loyalty = $2,415
  • High: Prism (non-core asset), where an IDOR allows reading a file uploaded to a user's Project. Historical example $1,000. New calculation: $2,500 × 1.15 × 1.10 Gold = $3,162.50
  • Critical: ChatGPT one-click account takeover. Historical example $6,500. New calculation: $30,000 × 1.15 × 1.30 priority campaign × 1.15 31337 tier = $51,577
  • Exceptional: significant compromise of a security boundary in ChatGPT, such as viewing arbitrary users' chat messages. Historical example $100,000. New calculation: $171,925

Retroactive payments and events

  • If you submitted a report and no bounty has been awarded yet, the new reward ranges apply
  • For bounties awarded in the 30 days before the announcement, OpenAI will pay the difference (base award plus loyalty awards) if the finding would have earned more under the new ranges
  • On November 20-21, the security team will be at PROMPT2PWN in Oakland to meet researchers testing targets in person

Wrap-up

  • The midpoint of reward ranges for medium, high, and critical findings is more than 4x higher on average
  • Critical findings in core products earn up to $30,000, and exceptional ones up to $172,000 with bonuses
  • Three new bonuses: report quality, loyalty (5 tiers), and priority campaigns
  • Pending reports and the last 30 days of awards get the new ranges retroactively

If you hunt for bugs in OpenAI products, this update is definitely worth checking out!

Related posts