OpenAI Raises Bug Bounty Rewards, Adds Report Quality, Loyalty and Campaign Bonuses

OpenAI is increasing the rewards paid out through its Security Bug Bounty program and adding three new bonus categories for independent security researchers: report quality, researcher loyalty, and priority campaign bonuses.

Each category nudges behavior in a different direction. A report quality bonus rewards the craft of explaining a finding — taken at face value, the same vulnerability is worth more to defenders when it arrives with a clear description and a reproducible proof. A loyalty bonus targets researchers who keep coming back over time rather than filing once. Priority campaign bonuses are aimed at specific targets OpenAI wants attention on during a defined window.

Bug bounty programs are one of the main channels through which AI companies buy outside security expertise. A model provider's attack surface is oddly shaped — API surfaces, training and inference infrastructure, and the account systems around them — and no internal team covers every corner of it.

The timing is notable: on the same day, OpenAI also published a post on preparing its next internal security sprint with Cathedral Systems to test and harden its defenses using AI. Read together, the two moves describe a two-sided posture — drills on the inside, purchased findings on the outside.

Splitting rewards into quality, loyalty and campaign buckets also suggests bug bounties are moving from 'pay by severity' toward 'pay for research behavior.' For researchers, that changes how a program should be evaluated: the headline maximum matters less than the structure of the bonuses and how predictable payment is.

What to watch: whether OpenAI publishes new totals or a new top payout, which systems the priority campaigns point at, and whether other frontier labs adjust their own reward structures in response.