OpenAI bug bounty programs
openai.com Updated
OpenAI runs 4 public programs on Bugcrowd, Sorona and its own site; 4 pay cash, the most up to $100,000 (OpenAI).
- Top reward
- $100,000
- Bugcrowd
- Programs
- 4
- 4 pay cash
- Targets in scope
- 24
- 5 types, deduplicated
- Last change
- 3 Nov 2026
- 1 week ago
Where to report
4 programs, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.
Start here
OpenAI
Bugcrowd · Pays the most of the 4 programs: up to $100,000.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
OpenAI
Bugcrowd · Bug bounty |
$30k (highest) | $7,000 (highest) | $3,000 (highest) | – | $100,000 | Partial | – | – | Open |
|
Safety Bug Bounty
Bugcrowd · Bug bounty |
$7,500 | $3,500 | $1,500 | $500 (highest) | $7,500 | Full | – | – | Open |
|
OpenAI Codex CLI
Sorona · Bug bounty |
$1,500 | $500 | $250 | $100 | $6,500 | Partial | – | – | Open |
|
cdn.openai.com
Self-hosted · Bug bounty |
– | – | – | – | Not published | – | – | – | Open |
-
- Critical
- $30k (highest)
- High
- $7,000 (highest)
- Medium
- $3,000 (highest)
- Low
- –
- Safe harbor
- Partial
-
- Critical
- $7,500
- High
- $3,500
- Medium
- $1,500
- Low
- $500 (highest)
- Safe harbor
- Full
-
- Critical
- $1,500
- High
- $500
- Medium
- $250
- Low
- $100
- Safe harbor
- Partial
Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
24 targets across all 4 programs, each listed once with the programs that cover it. 8 excluded.
-
Codex's MCP client and its server transports, where an attacker-controlled server is the input
Products and areas
Covered by Sorona
-
Credential, token and session storage, including the login flow the CLI authenticates through
Products and areas
Covered by Sorona
-
OpenAI's first-party services and APIs, which sit on the same Bugcrowd program although they are not open source
Products and areas
Covered by Sorona
-
openai/codex's own security policy is the declaration: OpenAI's security program runs through Bugcrowd and asks that validated vulnerabilities be reported there, which puts the Apache-2.0 Codex CLI repository on the paid program
Products and areas
Covered by Sorona
-
openai/openai-agents-python and the JS/TS Agents SDK, the agent-orchestration libraries, which route to OpenAI's coordinated vulnerability disclosure policy
Products and areas
Covered by Sorona
-
The approval-prompt and network-control layers, which stand between a model's suggested command and that command actually running
Products and areas
Covered by Sorona
-
The Codex CLI as a whole: session and configuration handling, the terminal interface, and the tool-execution layer that runs shell commands and applies patches
Products and areas
Covered by Sorona
-
The sandbox and its path-configuration logic, the boundary between the agent and the developer's real filesystem
Products and areas
Covered by Sorona
No target matches. Try part of a host name, such as the company name.
Out of scope 8
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
All model-behaviour work, in emphatic terms: "Issues related to the content of model prompts and responses are strictly out of scope for the Security and Safety Bug Bounty programs, and will not be rewarded unless they have an additional directly verifiable security impact on an in-scope service"
Sorona
-
Anything outside Bugcrowd's asset list, which needs an authenticated session to read: the public proof that openai/codex is a paying target is the repository's SECURITY.md rather than a scope row, so confirm the live list before you start
Sorona
-
Code execution from within the sandboxed Python interpreter: "This is an intended product feature", and the same for Agent Mode, which runs in a separate contained environment
Sorona
-
Jailbreaks and safety bypasses by name, including DAN and related prompts, getting the model to say bad things, and getting the model to write malicious code for you
Sorona
-
Model hallucinations, including getting the model to pretend to be a computer and execute code
Sorona
-
OpenAI models
Safety Bug Bounty
-
root access inside the container tool, which is not a privilege escalation because the root user has no special privileges outside a gVisor sandbox with no external network
Sorona
-
Safety and abuse issues, which belong to the separate OpenAI Safety bug bounty rather than to this one
Sorona
Recent changes
Reward and scope changes across every OpenAI program, newest first.
-
Scope − Bugcrowd
Removed from scope: https://*.openai.org
-
Scope − Bugcrowd
Removed from scope: https://chatgpt.com/dots/
-
Scope − Bugcrowd
Removed from scope: https://chat.openai.com
Recent CVEs
Published vulnerabilities in OpenAI products, from the NVD.
-
CVE-2025-7021 Medium
Fullscreen API Spoofing and UI Redressing in the handling of Fullscreen API and UI rendering in OpenAI Operator SaaS on Web allows a remote attacker to capture sensitive user input (e.g., login credentials, email addresses) via displaying a deceptive fullscreen interface with overlaid fake browser controls and a distracting element (like a cookie consent screen) to obscure fullscreen notifications
-
CVE-2025-7021 Medium
Fullscreen API Spoofing and UI Redressing in the handling of Fullscreen API and UI rendering in OpenAI Operator SaaS on Web allows a remote attacker to capture sensitive user input (e.g., login credentials, email addresses) via displaying a deceptive fullscreen interface with overlaid fake browser controls and a distracting element (like a cookie consent screen) to obscure fullscreen notifications
-
CVE-2025-7021 Medium
Fullscreen API Spoofing and UI Redressing in the handling of Fullscreen API and UI rendering in OpenAI Operator SaaS on Web allows a remote attacker to capture sensitive user input (e.g., login credentials, email addresses) via displaying a deceptive fullscreen interface with overlaid fake browser controls and a distracting element (like a cookie consent screen) to obscure fullscreen notifications
-
CVE-2025-43714 Medium
The ChatGPT system through 2025-03-30 performs inline rendering of SVG documents (instead of, for example, rendering them as text inside a code block), which enables HTML injection within most modern graphical web browsers.
-
CVE-2025-43714 Medium
The ChatGPT system through 2025-03-30 performs inline rendering of SVG documents (instead of, for example, rendering them as text inside a code block), which enables HTML injection within most modern graphical web browsers.
-
CVE-2025-43714 Medium
The ChatGPT system through 2025-03-30 performs inline rendering of SVG documents (instead of, for example, rendering them as text inside a code block), which enables HTML injection within most modern graphical web browsers.
About this page
This page gathers every public program listed under openai.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.