Injoys
OpenAI announced an expansion of its security bug bounty rewards on November 2, 2026. It introduced bonuses for independent security researchers. The maximum reward, including bonuses, is $172,000. Whether residents of South Korea can participate and receive rewards has not been confirmed.
OpenAI's announcement, reporting guidance, and public policy were reviewed as of November 4, 2026.
The maximum reward, including bonuses, has increased
OpenAI said it is expanding rewards for reporting security vulnerabilities. A bug bounty is a program that rewards researchers who find and report vulnerabilities, subject to certain conditions. This announcement set out the maximum reward, including bonuses.
Exceptionally severe vulnerabilities in core products remain eligible for existing rewards. OpenAI stated that the existing maximum for this category is $100,000. The maximum reward increases when a bonus is applied.
Eligibility for South Korean residents to participate in OpenAI’s bug bounty and receive rewards remains unconfirmed.AI-generated image
Check participation rules on the Bug Bounty page
Researchers planning to find and report vulnerabilities must check OpenAI's participation rules. OpenAI's public policy directs them to the Bug Bounty program page for detailed guidance. The maximum reward alone does not determine an individual's eligibility to participate.
OpenAI's help documentation requires compliance with the Coordinated Vulnerability Disclosure Policy. This policy covers vulnerability reporting and disclosure. Researchers must read and follow it to conduct research.
The amounts announced by the company are conditional maximum rewards
The amounts OpenAI announced are the maximum rewards applicable to the relevant category. This does not mean every vulnerability report receives the same amount. The amounts below are based on the November 2, 2026 announcement.
| Reward type | Applicable category | Maximum stated by OpenAI |
|---|---|---|
| Excluding bonuses | Exceptionally severe vulnerabilities in core products | $100,000 |
| Including bonuses | A bonus applied to vulnerabilities in the same category | $172,000 |
These figures are reward limits set by OpenAI. They are not performance figures measured by an independent organization. Nor can they be treated as researchers' average earnings or a record of actual payouts.
Eligibility in South Korea and campaign details have not been confirmed
Whether residents of South Korea can participate and receive rewards has not been confirmed. The announcement's exact publication time and time zone were not specified either. Its publication date and time in Korean time therefore cannot be determined.
The specific schedule and scope of the priority campaign have not been confirmed either. When considering participation, distinguish between the following items.
| Item to check | Current confirmation status |
|---|---|
| Whether researchers residing in South Korea can participate | Not confirmed |
| Whether researchers residing in South Korea can receive rewards | Not confirmed |
| The announcement's exact time and time zone | Not specified |
| The priority campaign's specific schedule and scope | Not confirmed |
What to check before starting research in South Korea
To participate from South Korea, first check eligibility and the conditions for receiving rewards. The documents to check are the Bug Bounty program rules and the vulnerability disclosure policy. Do not treat the announced maximum as an expected payout.
- Check the detailed participation rules on OpenAI's Bug Bounty program page.
- Confirm whether residents of South Korea can participate and receive rewards.
- Read and follow the Coordinated Vulnerability Disclosure Policy.
- If you plan to participate in the priority campaign, check its specific schedule and scope separately.
