OpenAI Bug Bounty Bonuses and Maximum Rewards
OpenAI said it may pay up to $172,000, including bonuses, for exceptionally critical vulnerabilities in its core products. Whether researchers residing in South Korea can participate and receive rewards has not been confirmed.
- On November 2, 2026, OpenAI announced increased security bug bounty rewards and the introduction of bonuses.
- Exceptionally critical vulnerabilities in core products qualify for an existing maximum reward of $100,000.
- Vulnerabilities in the same category qualify for rewards of up to $172,000, including bonuses.
- Researchers must read and follow the Coordinated Vulnerability Disclosure Policy.
- Whether residents of South Korea can participate and receive rewards remains unconfirmed, as do the specific schedule and targets of the priority campaign.
OpenAI announced an expansion of its security bug bounty rewards on November 2, 2026. It introduced bonuses for independent security researchers. The maximum reward, including bonuses, is $172,000. Whether residents of South Korea can participate and receive rewards has not been confirmed.
OpenAI's announcement, reporting guidance, and public policy were reviewed as of November 4, 2026.
The maximum reward, including bonuses, has increased
OpenAI said it is expanding rewards for reporting security vulnerabilities. A bug bounty is a program that rewards researchers who find and report vulnerabilities, subject to certain conditions. This announcement set out the maximum reward, including bonuses.
Exceptionally severe vulnerabilities in core products remain eligible for existing rewards. OpenAI stated that the existing maximum for this category is $100,000. The maximum reward increases when a bonus is applied.
Check participation rules on the Bug Bounty page
Researchers planning to find and report vulnerabilities must check OpenAI's participation rules. OpenAI's public policy directs them to the Bug Bounty program page for detailed guidance. The maximum reward alone does not determine an individual's eligibility to participate.
OpenAI's help documentation requires compliance with the Coordinated Vulnerability Disclosure Policy. This policy covers vulnerability reporting and disclosure. Researchers must read and follow it to conduct research.
The amounts announced by the company are conditional maximum rewards
The amounts OpenAI announced are the maximum rewards applicable to the relevant category. This does not mean every vulnerability report receives the same amount. The amounts below are based on the November 2, 2026 announcement.
| Reward type | Applicable category | Maximum stated by OpenAI |
|---|---|---|
| Excluding bonuses | Exceptionally severe vulnerabilities in core products | $100,000 |
| Including bonuses | A bonus applied to vulnerabilities in the same category | $172,000 |
These figures are reward limits set by OpenAI. They are not performance figures measured by an independent organization. Nor can they be treated as researchers' average earnings or a record of actual payouts.
Eligibility in South Korea and campaign details have not been confirmed
Whether residents of South Korea can participate and receive rewards has not been confirmed. The announcement's exact publication time and time zone were not specified either. Its publication date and time in Korean time therefore cannot be determined.
The specific schedule and scope of the priority campaign have not been confirmed either. When considering participation, distinguish between the following items.
| Item to check | Current confirmation status |
|---|---|
| Whether researchers residing in South Korea can participate | Not confirmed |
| Whether researchers residing in South Korea can receive rewards | Not confirmed |
| The announcement's exact time and time zone | Not specified |
| The priority campaign's specific schedule and scope | Not confirmed |
What to check before starting research in South Korea
To participate from South Korea, first check eligibility and the conditions for receiving rewards. The documents to check are the Bug Bounty program rules and the vulnerability disclosure policy. Do not treat the announced maximum as an expected payout.
- Check the detailed participation rules on OpenAI's Bug Bounty program page.
- Confirm whether residents of South Korea can participate and receive rewards.
- Read and follow the Coordinated Vulnerability Disclosure Policy.
- If you plan to participate in the priority campaign, check its specific schedule and scope separately.
FAQ
Can researchers residing in Korea also participate and receive rewards?
It has not been confirmed whether researchers residing in Korea can participate and receive rewards. You must check the detailed rules on OpenAI's Bug Bounty program page.
Can I receive $172,000 for reporting a vulnerability from Korea?
$172,000 is the maximum, including bonuses, for exceptionally severe vulnerabilities in core products. It is not the payout for an individual report. Whether residents of Korea can receive rewards must also be checked separately.
What documents should I read before starting security research in Korea?
OpenAI instructs researchers to read and follow the Coordinated Vulnerability Disclosure Policy. Detailed participation guidelines and rules can be found on the Bug Bounty program page.
Sources
Images
