OpenAI quadruples rewards for hackers who find flaws in ChatGPT
The San Francisco company will pay up to $172,000 for the worst bugs and is bringing in an outside firm to attack its own systems with help from its AI.
OpenAI, the San Francisco maker of ChatGPT, said Monday it will pay outside security researchers far more for finding holes in its software.
A "bug bounty" is a standing offer of cash to anyone who finds a security flaw and reports it privately, so the company can fix it before criminals use it. OpenAI said it is more than quadrupling, on average, the middle of its payment ranges for medium, high and critical flaws.
A critical bug in ChatGPT, its Codex coding tool or its service for developers now pays up to $30,000. The most serious finds, such as a way to read other people's chats, stay eligible for up to $100,000, and with new bonuses for high-quality reports, repeat finders and special campaigns, up to about $172,000. In one example OpenAI gave, a one-click account takeover that once earned $6,500 would now pay about $51,577.
Fighting AI-found bugs with AI
OpenAI also said it will run another internal "security sprint" with Cathedral, an outside security firm whose researchers will use OpenAI's own models to attack its defenses. In its last sprint, OpenAI said, a quarter of its product engineers spent time finding and fixing weaknesses with help from its AI tools.
The moves come as AI tools find software flaws faster than companies can patch them, a worry across Silicon Valley. OpenAI says more than 1 billion people use ChatGPT each week, so the stakes include a huge number of private conversations.
OpenAI's security team will meet researchers at the PROMPT2PWN hacking event in Oakland Nov. 20-21.
Source: OpenAI announcements, Nov. 2, 2026.