OpenAI Raises Bug Bounty to $172,000 and Prepares for a Sprint

OpenAI significantly increases the rewards offered to security researchers and plans a new internal sprint with the support of Cathedral. The amounts rise to $172,000 thanks to bonuses, while a loyalty program and temporary campaigns are introduced.

A Sprint with Cathedral and 25% of Engineers Engaged in the Previous One

OpenAI is preparing a new security sprint in which the security company Cathedral will participate to test the robustness of its systems. During the previous sprint, 25% of OpenAI's product engineers took part in the search for vulnerabilities, according to the company. This new sprint is announced as forthcoming.

Amounts Raised to $30,000 and $100,000, with Bonuses Up to $172,000

It is now possible to earn up to $30,000 for discovering critical vulnerabilities in services such as ChatGPT or Codex. Reports deemed exceptional can lead to a maximum reward of $100,000, and by combining bonuses related to quality, loyalty, and campaigns, the total amount can approach $172,000. OpenAI is also implementing a structured loyalty system with five tiers, as well as temporary campaigns with increased rewards during the rollout of new features.

Positioning Against Giants and Retroactivity for 30 Days

With these new ceilings, OpenAI positions itself in the same range as Google's bounty program for vulnerability detection, although the amounts remain below those offered by Apple or Microsoft for vulnerabilities affecting the operating system. Anyone who reported a vulnerability in the last 30 days will receive an additional payment corresponding to the difference between the old and new pricing structure. OpenAI specifies that it has quadrupled the amounts paid under its bug bounty program.