OpenAI puts $20K bounty on its own bugs, taps Bugcrowd

It’s not just a polite request anymore. OpenAI is officially putting cash on the table — up to $20,000 — for anyone who can find and responsibly disclose a security flaw in its systems. The launch of the OpenAI Bug Bounty Program marks a formal escalation from coordinated disclosure to a paid incentive model, a move that signals just how seriously the company is taking the messy reality of securing frontier AI models.

The program will be managed through Bugcrowd, the well-known bug bounty platform, which will handle the triage and payment pipeline. The reward structure is tiered by severity, starting at a modest $200 for low-level findings and scaling up sharply. That $20,000 top tier is reserved for what the company calls “exceptional discoveries,” a vague but tantalizing ceiling that should get the attention of serious vulnerability researchers.

OpenAI’s language in the announcement is careful — almost disarmingly so. They admit outright that “vulnerabilities and flaws can emerge” in complex technology, a frank acknowledgment from a company whose products are now embedded in everything from customer service bots to code generation tools. The subtext is clear: as the attack surface expands, so does the risk, and internal red-teaming can only cover so much ground.

There’s also a recruitment angle here that’s barely veiled. The announcement ends with a direct pitch to check out open security roles on OpenAI’s careers page. It’s a smart two-for-one: pay independent researchers to stress-test your infrastructure while simultaneously fishing for the talent that impresses you most. Whether the program uncovers genuinely novel attack vectors in large language models — prompt injection, data exfiltration, model theft — or just garden-variety web app bugs remains to be seen. But for a company that talks constantly about safety, putting a price tag on outside scrutiny feels like a logical, if overdue, step.