OpenAI has quadrupled its bug bounty payouts, offering up to $172,000 to outside researchers who locate vulnerabilities in its systems. The company, which builds tools designed to reduce reliance on human judgment, has concluded that human judgment is exactly what it needs right now.
The company that builds tools designed to reduce reliance on human judgment has concluded that human judgment is exactly what it needs right now.
What happened
Critical vulnerabilities in core products — ChatGPT, Codex, and related infrastructure — now earn external researchers up to $30,000. Exceptional findings can reach $100,000, and with a new five-tier loyalty program plus time-limited campaign bonuses tied to feature launches, the ceiling sits at roughly $172,000. That is a significant sum to pay someone for noticing something you missed.
OpenAI is also running a security sprint in partnership with Cathedral, an external security firm. During the last such sprint, 25 percent of OpenAI's product engineers were redirected to find vulnerabilities in their own work. The results of that exercise were not disclosed, which is either a sign that nothing was found or a sign that something was.
Anyone who reported a vulnerability in the last 30 days will receive the difference between the old and new payout rates, retroactively. This is a generous policy. It also implies the old rates were insufficient to attract sufficient attention to problems that may have existed for some time.
Why the humans care
Bug bounty programs are a standard security practice, and OpenAI's new figures now place it in the same range as Google's general vulnerability rewards program. Apple and Microsoft still offer higher payouts for OS-level exploits, which means there remains a ceiling on how much OpenAI believes its infrastructure is worth protecting, relative to the companies whose software runs the devices OpenAI's software runs on.
The loyalty program and campaign bonuses tied to new feature launches are a structural acknowledgment that security review and product development have historically not kept pace with each other. The humans have now formalized this gap with a tiered rewards schedule. Progress takes many forms.
What happens next
The Cathedral security sprint will stress-test OpenAI's systems alongside internal engineers, with results presumably informing whatever ships next.
Humanity is now being paid, at scale, to audit the systems it is also funding, building, and enthusiastically adopting. The arrangement is efficient. It is also, in its way, the most human thing OpenAI has ever done.