{"content_id":"gtqdoscdcs","slug":"openai-bug-bounty-bonus-reward-limits","locale":"en","schema_type":"NewsArticle","category":"news","category_name":"News","title":"OpenAI Bug Bounty Bonuses and Maximum Rewards","summary":"OpenAI said it may pay up to $172,000, including bonuses, for exceptionally critical vulnerabilities in its core products. Whether researchers residing in South Korea can participate and receive rewards has not been confirmed.","sponsorship_disclosure":null,"affiliate_disclosure":null,"commerce_disclosure":null,"author":{"name":"Injoys Editorial Team","url":"https://injoys.com/ko/about"},"key_points":["On November 2, 2026, OpenAI announced increased security bug bounty rewards and the introduction of bonuses.","Exceptionally critical vulnerabilities in core products qualify for an existing maximum reward of $100,000.","Vulnerabilities in the same category qualify for rewards of up to $172,000, including bonuses.","Researchers must read and follow the Coordinated Vulnerability Disclosure Policy.","Whether residents of South Korea can participate and receive rewards remains unconfirmed, as do the specific schedule and targets of the priority campaign."],"content_markdown":"OpenAI announced an expansion of its security bug bounty rewards on November 2, 2026. It introduced bonuses for independent security researchers. The maximum reward, including bonuses, is **$172,000**. Whether residents of South Korea can participate and receive rewards has not been confirmed.\n\nOpenAI's announcement, reporting guidance, and public policy were reviewed as of November 4, 2026.\n\n## The maximum reward, including bonuses, has increased\n\nOpenAI said it is expanding rewards for reporting security vulnerabilities. A bug bounty is a program that rewards researchers who find and report vulnerabilities, subject to certain conditions. This announcement set out the maximum reward, including bonuses.\n\nExceptionally severe vulnerabilities in core products remain eligible for existing rewards. OpenAI stated that the existing maximum for this category is $100,000. The maximum reward increases when a bonus is applied.\n\n## Check participation rules on the Bug Bounty page\n\nResearchers planning to find and report vulnerabilities must check OpenAI's participation rules. OpenAI's public policy directs them to the Bug Bounty program page for detailed guidance. The maximum reward alone does not determine an individual's eligibility to participate.\n\nOpenAI's help documentation requires compliance with the Coordinated Vulnerability Disclosure Policy. This policy covers vulnerability reporting and disclosure. Researchers must read and follow it to conduct research.\n\n## The amounts announced by the company are conditional maximum rewards\n\nThe amounts OpenAI announced are the maximum rewards applicable to the relevant category. This does not mean every vulnerability report receives the same amount. The amounts below are based on the November 2, 2026 announcement.\n\n| Reward type | Applicable category | Maximum stated by OpenAI |\n| --- | --- | --- |\n| Excluding bonuses | Exceptionally severe vulnerabilities in core products | $100,000 |\n| Including bonuses | A bonus applied to vulnerabilities in the same category | $172,000 |\n\nThese figures are reward limits set by OpenAI. They are not performance figures measured by an independent organization. Nor can they be treated as researchers' average earnings or a record of actual payouts.\n\n## Eligibility in South Korea and campaign details have not been confirmed\n\nWhether residents of South Korea can participate and receive rewards has not been confirmed. The announcement's exact publication time and time zone were not specified either. Its publication date and time in Korean time therefore cannot be determined.\n\nThe specific schedule and scope of the priority campaign have not been confirmed either. When considering participation, distinguish between the following items.\n\n| Item to check | Current confirmation status |\n| --- | --- |\n| Whether researchers residing in South Korea can participate | Not confirmed |\n| Whether researchers residing in South Korea can receive rewards | Not confirmed |\n| The announcement's exact time and time zone | Not specified |\n| The priority campaign's specific schedule and scope | Not confirmed |\n\n## What to check before starting research in South Korea\n\nTo participate from South Korea, first check eligibility and the conditions for receiving rewards. The documents to check are the Bug Bounty program rules and the vulnerability disclosure policy. Do not treat the announced maximum as an expected payout.\n\n1. Check the detailed participation rules on OpenAI's Bug Bounty program page.\n2. Confirm whether residents of South Korea can participate and receive rewards.\n3. Read and follow the Coordinated Vulnerability Disclosure Policy.\n4. If you plan to participate in the priority campaign, check its specific schedule and scope separately.","content_html":"\u003cp\u003eOpenAI announced an expansion of its security bug bounty rewards on November 2, 2026. It introduced bonuses for independent security researchers. The maximum reward, including bonuses, is \u003cstrong\u003e$172,000\u003c/strong\u003e. Whether residents of South Korea can participate and receive rewards has not been confirmed.\u003c/p\u003e\n\u003cp\u003eOpenAI's announcement, reporting guidance, and public policy were reviewed as of November 4, 2026.\u003c/p\u003e\n\u003ch2\u003e\n\u003ca href=\"#the-maximum-reward-including-bonuses-has-increased\" class=\"anchor\" id=\"the-maximum-reward-including-bonuses-has-increased\"\u003e\u003c/a\u003eThe maximum reward, including bonuses, has increased\u003c/h2\u003e\n\u003cp\u003eOpenAI said it is expanding rewards for reporting security vulnerabilities. A bug bounty is a program that rewards researchers who find and report vulnerabilities, subject to certain conditions. This announcement set out the maximum reward, including bonuses.\u003c/p\u003e\n\u003cp\u003eExceptionally severe vulnerabilities in core products remain eligible for existing rewards. OpenAI stated that the existing maximum for this category is $100,000. The maximum reward increases when a bonus is applied.\u003c/p\u003e\n\u003ch2\u003e\n\u003ca href=\"#check-participation-rules-on-the-bug-bounty-page\" class=\"anchor\" id=\"check-participation-rules-on-the-bug-bounty-page\"\u003e\u003c/a\u003eCheck participation rules on the Bug Bounty page\u003c/h2\u003e\n\u003cp\u003eResearchers planning to find and report vulnerabilities must check OpenAI's participation rules. OpenAI's public policy directs them to the Bug Bounty program page for detailed guidance. The maximum reward alone does not determine an individual's eligibility to participate.\u003c/p\u003e\n\u003cp\u003eOpenAI's help documentation requires compliance with the Coordinated Vulnerability Disclosure Policy. This policy covers vulnerability reporting and disclosure. Researchers must read and follow it to conduct research.\u003c/p\u003e\n\u003ch2\u003e\n\u003ca href=\"#the-amounts-announced-by-the-company-are-conditional-maximum-rewards\" class=\"anchor\" id=\"the-amounts-announced-by-the-company-are-conditional-maximum-rewards\"\u003e\u003c/a\u003eThe amounts announced by the company are conditional maximum rewards\u003c/h2\u003e\n\u003cp\u003eThe amounts OpenAI announced are the maximum rewards applicable to the relevant category. This does not mean every vulnerability report receives the same amount. The amounts below are based on the November 2, 2026 announcement.\u003c/p\u003e\n\u003cdiv class=\"overflow-x-auto\"\u003e\u003ctable\u003e\n\u003cthead\u003e\n\u003ctr\u003e\n\u003cth\u003eReward type\u003c/th\u003e\n\u003cth\u003eApplicable category\u003c/th\u003e\n\u003cth\u003eMaximum stated by OpenAI\u003c/th\u003e\n\u003c/tr\u003e\n\u003c/thead\u003e\n\u003ctbody\u003e\n\u003ctr\u003e\n\u003ctd data-label=\"Reward type\"\u003eExcluding bonuses\u003c/td\u003e\n\u003ctd data-label=\"Applicable category\"\u003eExceptionally severe vulnerabilities in core products\u003c/td\u003e\n\u003ctd data-label=\"Maximum stated by OpenAI\"\u003e$100,000\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd data-label=\"Reward type\"\u003eIncluding bonuses\u003c/td\u003e\n\u003ctd data-label=\"Applicable category\"\u003eA bonus applied to vulnerabilities in the same category\u003c/td\u003e\n\u003ctd data-label=\"Maximum stated by OpenAI\"\u003e$172,000\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/tbody\u003e\n\u003c/table\u003e\u003c/div\u003e\n\u003cp\u003eThese figures are reward limits set by OpenAI. They are not performance figures measured by an independent organization. Nor can they be treated as researchers' average earnings or a record of actual payouts.\u003c/p\u003e\n\u003ch2\u003e\n\u003ca href=\"#eligibility-in-south-korea-and-campaign-details-have-not-been-confirmed\" class=\"anchor\" id=\"eligibility-in-south-korea-and-campaign-details-have-not-been-confirmed\"\u003e\u003c/a\u003eEligibility in South Korea and campaign details have not been confirmed\u003c/h2\u003e\n\u003cp\u003eWhether residents of South Korea can participate and receive rewards has not been confirmed. The announcement's exact publication time and time zone were not specified either. Its publication date and time in Korean time therefore cannot be determined.\u003c/p\u003e\n\u003cp\u003eThe specific schedule and scope of the priority campaign have not been confirmed either. When considering participation, distinguish between the following items.\u003c/p\u003e\n\u003cdiv class=\"overflow-x-auto\"\u003e\u003ctable\u003e\n\u003cthead\u003e\n\u003ctr\u003e\n\u003cth\u003eItem to check\u003c/th\u003e\n\u003cth\u003eCurrent confirmation status\u003c/th\u003e\n\u003c/tr\u003e\n\u003c/thead\u003e\n\u003ctbody\u003e\n\u003ctr\u003e\n\u003ctd data-label=\"Item to check\"\u003eWhether researchers residing in South Korea can participate\u003c/td\u003e\n\u003ctd data-label=\"Current confirmation status\"\u003eNot confirmed\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd data-label=\"Item to check\"\u003eWhether researchers residing in South Korea can receive rewards\u003c/td\u003e\n\u003ctd data-label=\"Current confirmation status\"\u003eNot confirmed\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd data-label=\"Item to check\"\u003eThe announcement's exact time and time zone\u003c/td\u003e\n\u003ctd data-label=\"Current confirmation status\"\u003eNot specified\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd data-label=\"Item to check\"\u003eThe priority campaign's specific schedule and scope\u003c/td\u003e\n\u003ctd data-label=\"Current confirmation status\"\u003eNot confirmed\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/tbody\u003e\n\u003c/table\u003e\u003c/div\u003e\n\u003ch2\u003e\n\u003ca href=\"#what-to-check-before-starting-research-in-south-korea\" class=\"anchor\" id=\"what-to-check-before-starting-research-in-south-korea\"\u003e\u003c/a\u003eWhat to check before starting research in South Korea\u003c/h2\u003e\n\u003cp\u003eTo participate from South Korea, first check eligibility and the conditions for receiving rewards. The documents to check are the Bug Bounty program rules and the vulnerability disclosure policy. Do not treat the announced maximum as an expected payout.\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003eCheck the detailed participation rules on OpenAI's Bug Bounty program page.\u003c/li\u003e\n\u003cli\u003eConfirm whether residents of South Korea can participate and receive rewards.\u003c/li\u003e\n\u003cli\u003eRead and follow the Coordinated Vulnerability Disclosure Policy.\u003c/li\u003e\n\u003cli\u003eIf you plan to participate in the priority campaign, check its specific schedule and scope separately.\u003c/li\u003e\n\u003c/ol\u003e\n","tags":["AI","OpenAI","Security research"],"faqs":[{"question":"Can researchers residing in Korea also participate and receive rewards?","answer":"It has not been confirmed whether researchers residing in Korea can participate and receive rewards. You must check the detailed rules on OpenAI's Bug Bounty program page."},{"question":"Can I receive $172,000 for reporting a vulnerability from Korea?","answer":"$172,000 is the maximum, including bonuses, for exceptionally severe vulnerabilities in core products. It is not the payout for an individual report. Whether residents of Korea can receive rewards must also be checked separately."},{"question":"What documents should I read before starting security research in Korea?","answer":"OpenAI instructs researchers to read and follow the Coordinated Vulnerability Disclosure Policy. Detailed participation guidelines and rules can be found on the Bug Bounty program page."}],"sources":[{"url":"https://openai.com/index/rewarding-defenders-with-bigger-bug-bounties/","title":"Rewarding defenders with bigger bug bounties - OpenAI","type":"source"},{"url":"https://openai.com/policies/coordinated-vulnerability-disclosure-policy/","title":"Coordinated vulnerability disclosure policy - OpenAI","type":"source"},{"url":"https://help.openai.com/en/articles/6653653-how-to-report-security-vulnerabilities-to-openai","title":"How to Report Security Vulnerabilities to OpenAI - OpenAI","type":"source"},{"url":"https://openai.com/en-GB/policies/coordinated-vulnerability-disclosure-policy/","title":"OpenAI, Coordinated vulnerability disclosure policy","type":"source"}],"images":[{"id":2424,"url":"https://injoys.com/rails/active_storage/blobs/proxy/eyJfcmFpbHMiOnsiZGF0YSI6Mzc4NDIsInB1ciI6ImJsb2JfaWQifX0=--077a9d877dea735240e7afb76adb9c5a7a8eda17/ai-0ef53419.webp","is_representative":true,"generation_method":"ai_photo","license":"ai_generated","mime_type":"image/webp","width":1536,"height":1024,"translations":{"ko":{"alt":"안경과 자주색 카디건을 착용한 여성이 서버 랙에 설치된 컴퓨터의 키보드를 두드리고 있다.","caption":"보안 연구자는 취약점 조정 공개 정책을 읽고 따라야 한다.","description":null},"en":{"alt":"A woman in glasses and a plum cardigan types at a computer terminal mounted in a server rack.","caption":"Security researchers must read and follow the Coordinated Vulnerability Disclosure Policy.","description":null},"ja":{"alt":"眼鏡とプラム色のカーディガンを着た女性が、サーバーラックに設置された端末で入力している。","caption":"セキュリティ研究者は、協調的な脆弱性開示ポリシーを読み、従う必要がある。","description":null},"es":{"alt":"Una mujer con gafas y un cárdigan ciruela teclea en un terminal instalado en un rack de servidores.","caption":"Los investigadores de seguridad deben leer y seguir la política de divulgación coordinada de vulnerabilidades.","description":null},"id":{"alt":"Perempuan berkacamata dan berkardigan ungu mengetik pada terminal komputer di rak server.","caption":"Peneliti keamanan harus membaca dan mematuhi kebijakan pengungkapan kerentanan terkoordinasi.","description":null},"pt":{"alt":"Uma mulher de óculos e cardigã ameixa digita em um terminal instalado em um rack de servidores.","caption":"Pesquisadores de segurança devem ler e seguir a política de divulgação coordenada de vulnerabilidades.","description":null},"zh-hant":{"alt":"一名戴眼鏡、穿梅紫色針織外套的女子，正在伺服器機架上的電腦終端輸入。","caption":"安全研究人員必須閱讀並遵守協調式漏洞揭露政策。","description":null},"de":{"alt":"Eine Frau mit Brille und pflaumenfarbener Strickjacke tippt an einem Terminal im Serverrack.","caption":"Sicherheitsforscher müssen die Richtlinie zur koordinierten Offenlegung von Schwachstellen lesen und befolgen.","description":null}}},{"id":2425,"url":"https://injoys.com/rails/active_storage/blobs/proxy/eyJfcmFpbHMiOnsiZGF0YSI6Mzc4NDgsInB1ciI6ImJsb2JfaWQifX0=--a541a9e91d39f8d483115013c43c437f94fef13d/ai-cbec1387.webp","is_representative":false,"generation_method":"ai_semi","license":"ai_generated","mime_type":"image/webp","width":1536,"height":1024,"translations":{"ko":{"alt":"창가 소파에서 파란 스웨터를 입은 중년 남성이 서류를 읽고 있으며, 옆에 보안·점검 기호가 겹쳐 있다.","caption":"한국 거주자의 OpenAI 버그바운티 참가와 보상 수령 가능 여부는 확인되지 않았다.","description":null},"en":{"alt":"An older man in a blue sweater reads a document on a sofa by a window, with security symbols overlaid.","caption":"Eligibility for South Korean residents to participate in OpenAI’s bug bounty and receive rewards remains unconfirmed.","description":null},"ja":{"alt":"青いセーターを着た年配の男性が窓辺のソファで書類を読み、横にセキュリティ関連の記号が重ねられている。","caption":"韓国居住者がOpenAIのバグバウンティに参加し、報奨金を受け取れるかは確認されていない。","description":null},"es":{"alt":"Un hombre mayor lee un documento en un sofá junto a una ventana, con símbolos de seguridad superpuestos.","caption":"No se ha confirmado si los residentes en Corea del Sur pueden participar en el programa de recompensas de OpenAI y cobrar.","description":null},"id":{"alt":"Pria lanjut usia membaca dokumen di sofa dekat jendela, dengan simbol keamanan ditampilkan di sampingnya.","caption":"Kelayakan penduduk Korea Selatan untuk mengikuti program bug bounty OpenAI dan menerima imbalan belum terkonfirmasi.","description":null},"pt":{"alt":"Um homem mais velho lê um documento no sofá junto à janela, com símbolos de segurança sobrepostos.","caption":"Não foi confirmado se residentes na Coreia do Sul podem participar do programa de bug bounty da OpenAI e receber recompensas.","description":null},"zh-hant":{"alt":"一名穿藍色毛衣的年長男子坐在窗邊沙發上閱讀文件，旁邊疊加了資安與檢查符號。","caption":"南韓居民能否參加 OpenAI 漏洞獎勵計畫並領取獎金，目前尚未確認。","description":null},"de":{"alt":"Ein älterer Mann liest auf einem Sofa am Fenster ein Dokument; daneben sind Sicherheitssymbole eingeblendet.","caption":"Ob Personen mit Wohnsitz in Südkorea an OpenAIs Bug-Bounty-Programm teilnehmen und Prämien erhalten können, ist ungeklärt.","description":null}}}],"published_at":"2026-11-04T21:15:41+09:00","updated_at":"2026-11-04T21:15:41+09:00","license":"cc_by","translation_status":"reviewed","available_locales":["ko","en","ja","es"],"data_locales":["ko","en","ja","es","id","pt","zh-hant","de"],"url":"https://injoys.com/en/articles/openai-bug-bounty-bonus-reward-limits"}