OpenAI raises Security Bug Bounty rewards and adds new bonuses
OpenAI announced changes to its Security Bug Bounty program, the channel through which independent security researchers report vulnerabilities and are paid for them.
Two changes are named. First, OpenAI is raising the rewards the program pays. Second, it is introducing three kinds of bonus for independent security researchers: a report quality bonus, a loyalty bonus and a priority campaign bonus.
That is the whole of what the announcement text available to us says. No reward amounts, old or new maximums, or percentage increases are given. No bonus sizes or eligibility criteria are given for the report quality, loyalty or priority campaign bonuses. No effective date or timescale for the changes is given, and the reason for the change is not stated. The scope of the program, meaning which products or systems are covered, is also not stated.
Key facts
- OpenAI is raising rewards in its Security Bug Bounty program.
- Three new bonuses are being introduced: report quality, loyalty and priority campaign.
- The bonuses are aimed at independent security researchers.
- No reward amounts, bonus sizes, eligibility criteria or effective dates are given in the available text.
Why it matters
Bug bounties are how a company pays outside researchers to report vulnerabilities to it. Higher payouts and extra bonuses signal that OpenAI wants more and better reports from that community. The three bonus types point to what it wants to reward: well-written reports, researchers who keep returning, and work on priority campaigns. The reason for the change is not stated.
Who it affects
The announcement targets independent security researchers who report issues to OpenAI through its Security Bug Bounty program. The scope of the program, meaning which products or systems are covered, is not stated.
How to use it
Researchers who already take part in the program, or who are considering it, should look at OpenAI's own announcement and program pages for the actual reward tables, bonus sizes and eligibility criteria. None of these are given in the text available here, so there is nothing concrete to act on from this summary alone.
How solid is it
This is a first-party announcement published by OpenAI, so the fact of the change is well sourced. The detail is thin: the primary source is unavailable beyond a one-sentence summary, and it gives no figures, dates or named spokesperson.
Risks and caveats
Without amounts, it is impossible to say how large the increase is or how much the new bonuses add to a typical payout. No effective date is given, so it is unclear whether the changes apply now or later. Treat any claim about the size of the change as unverified until OpenAI publishes the details.