Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Yes. OpenAI announced on March 26, 2025, that its Security Bug Bounty could pay up to $100,000 for “exceptional and differentiated critical findings,” raising the previous maximum of $20,000. That is a ceiling, not a standard payout for every report rated critical. To qualify, a finding must meet the live program brief’s scope and rules; the brief also governs current reward terms and how to submit.
What the $100,000 bounty means
OpenAI’s March 26, 2025 security announcement describes $100,000 as the maximum payout for exceptional and differentiated critical findings. The wording matters: it does not promise $100,000 for every critical-severity vulnerability, nor does it establish a fixed payout for any particular report. A finding’s eligibility and reward depend on the program’s current brief and assessment.
OpenAI launched its Security Bug Bounty on April 11, 2023. At launch, the company described rewards ranging from $200 for low-severity findings to as much as $20,000 for exceptional discoveries, with Bugcrowd managing submissions and rewards. Those launch figures are historical; they should not be treated as today’s complete reward schedule.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →What findings may qualify
The announcement’s qualifier is “exceptional and differentiated critical findings.” It does not provide a universal technical definition of critical severity or a checklist that guarantees a particular award. In practice, researchers should first establish that a finding affects an asset included in the current program brief and then report enough evidence for the program to assess its impact.
#1 Best Overall
- Check scope: The active OpenAI Security Bug Bounty brief identifies eligible targets and excluded findings. A vulnerability in an unlisted system may not qualify.
- Demonstrate impact safely: Describe the vulnerability, affected target, reproducible steps and security consequences without disrupting services or accessing other people’s data.
- Follow the current rules: The brief controls submission requirements, reward details and disclosure expectations. Scope and terms can change.
The $100,000 figure is therefore a maximum associated with an exceptional category, not a rate researchers can claim in advance. OpenAI’s 2025 announcement does not spell out a formula for deciding whether a report is exceptional or differentiated.
How to submit a security vulnerability
- Read the live OpenAI Security Bug Bounty brief on Bugcrowd. Confirm the target, scope, exclusions, current reward terms and any program-specific testing instructions before beginning.
- Test only as the brief permits. Bugcrowd’s standard terms limit testing to listed systems and prohibit actions that affect target integrity or availability. Use test accounts if the brief requires them, and protect confidential information.
- Submit through Crowdcontrol. Bugcrowd’s standard terms say submissions must be made through Crowdcontrol to qualify for a reward. Include clear reproduction steps and impact evidence, and follow the program’s disclosure policy.
- Wait for assessment before disclosing details. OpenAI’s coordinated vulnerability disclosure policy encourages responsible reporting and directs researchers to its Bug Bounty program.
Because the active brief is the controlling source, check it directly rather than relying on older descriptions of targets, exclusions or payout tiers.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Security bounty and Safety Bug Bounty are different programs
OpenAI introduced a public Safety Bug Bounty on March 25, 2026, for issues presenting meaningful abuse or safety risks even when they do not meet conventional security-vulnerability criteria. It complements, rather than replaces, the Security Bug Bounty whose $100,000 maximum was announced in 2025.
Free tools Windows power users keep installed
One-click scans. No signup required.
| Question | Security Bug Bounty | Safety Bug Bounty |
|---|---|---|
| What kind of issue? | Conventional security vulnerabilities. | Meaningful abuse or safety risks, including issues outside conventional vulnerability criteria. |
| What evidence matters? | Evidence of a security vulnerability on an in-scope target; the live brief defines eligible scope and rules. | OpenAI says reports may be considered case by case when they show a direct path to user harm and actionable remediation. |
| Are general jailbreaks eligible? | Not established by the 2025 security announcement; check the current security brief. | General jailbreaks without demonstrable safety or abuse impact are out of scope. |
| Reward information | Maximum of $100,000 for exceptional and differentiated critical findings, announced March 26, 2025; current terms are in the live brief. | Reward details are not stated in OpenAI’s March 25, 2026 announcement. |
| How to report | Bugcrowd program brief and Crowdcontrol submission process. | Use the Safety Bug Bounty’s published reporting route and rules. |
A jailbreak or harmful model behavior should not automatically be filed as a conventional security vulnerability. Choose the program based on the type of risk and its published scope, and do not assume that either program’s criteria or reward terms apply to the other.
Quick Recap
Best Value
Rank #3
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
