[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"news-post-\u002Fnews\u002Fopenai-bug-bounty-172000-chatgpt-codex-api":3,"news-related-en-\u002Fnews\u002Fopenai-bug-bounty-172000-chatgpt-codex-api":123,"hreflang-openai-bug-bounty-172000-2026-11":141},{"doc":4,"redirect":8},{"id":5,"title":6,"author":7,"author_avatar":8,"body":9,"category":103,"date":104,"description":105,"extension":106,"image":107,"meta":108,"navigation":109,"path":110,"seo":111,"seoDescription":112,"seoTitle":113,"stem":114,"tags":115,"translationKey":121,"updatedAt":8,"__hash__":122},"news_en\u002Fnews\u002Fopenai-bug-bounty-172000-chatgpt-codex-api.md","OpenAI raises its bug bounty: up to $172,000 for the worst ChatGPT flaws","Paul Lefizelier",null,{"type":10,"value":11,"toc":95},"minimark",[12,25,30,38,42,49,72,76,82,88,92],[13,14,15,16,24],"p",{},"On 2 November 2026, OpenAI ",[17,18,23],"a",{"href":19,"rel":20,"target":22},"https:\u002F\u002Fopenai.com\u002Findex\u002Frewarding-defenders-with-bigger-bug-bounties",[21],"nofollow","_blank","announced higher rewards"," in its Security Bug Bounty program. The company says it is \"more than quadrupling the midpoint of our reward ranges for medium, high, and critical findings on average.\"",[26,27,29],"h2",{"id":28},"the-new-ceilings","The new ceilings",[13,31,32,33,37],{},"A critical vulnerability in a core product, ChatGPT, Codex or the API Platform, now earns up to $30,000. Exceptional critical findings on those targets remain eligible for up to $100,000, \"and now up to $172,000 with bonuses\" (",[17,34,36],{"href":19,"rel":35,"target":22},[21],"OpenAI",").",[26,39,41],{"id":40},"three-bonus-multipliers","Three bonus multipliers",[13,43,44,45,48],{},"OpenAI adds three multipliers on top of the base bounty (",[17,46,36],{"href":19,"rel":47,"target":22},[21],"):",[50,51,52,60,66],"ul",{},[53,54,55,59],"li",{},[56,57,58],"strong",{},"Quality:"," a reliable proof of concept that isolates the bug, shows when it can be exploited and demonstrates its impact.",[53,61,62,65],{},[56,63,64],{},"Loyalty:"," a five-tier program for researchers who report consistently.",[53,67,68,71],{},[56,69,70],{},"Priority campaigns:"," short-term bonus pools for newly launched features.",[26,73,75],{"id":74},"what-the-examples-show","What the examples show",[13,77,78,79,37],{},"OpenAI published illustrative calculations. A one-click ChatGPT account takeover, previously awarded $6,500, would now pay $51,577 ($30,000 × 1.15 quality × 1.30 priority campaign × 1.15 top loyalty tier). A significant security-boundary compromise, such as reading arbitrary users' ChatGPT messages, comes to $171,925 ($100,000 with the same multipliers). A medium ChatGPT bug that once paid $750 would now pay $2,415 (",[17,80,36],{"href":19,"rel":81,"target":22},[21],[13,83,84,85,37],{},"Reports not yet awarded get the new ranges. For bounties paid in the 30 days before the announcement, OpenAI will pay the difference if the finding would have earned more (base and loyalty awards). Its security team will also be at PROMPT2PWN in Oakland on 20 and 21 November (",[17,86,36],{"href":19,"rel":87,"target":22},[21],[26,89,91],{"id":90},"why-it-matters","Why it matters",[13,93,94],{},"ChatGPT and Codex now hold chat histories, files, code and connected accounts for a very large user base. The top example OpenAI chose, reading other users' chats, is the risk most users care about. Paying more for those reports gives researchers a stronger reason to disclose privately rather than sell or publish. For teams building on the API, it is also a sign of where OpenAI sees its most sensitive attack surface.",{"title":96,"searchDepth":97,"depth":97,"links":98},"",2,[99,100,101,102],{"id":28,"depth":97,"text":29},{"id":40,"depth":97,"text":41},{"id":74,"depth":97,"text":75},{"id":90,"depth":97,"text":91},"ai","2026-11-04T17:30:00","On 2 November 2026, OpenAI raised Security Bug Bounty rewards. Critical bugs in ChatGPT, Codex or the API Platform now pay up to $30,000, and exceptional findings up to $172,000 with new bonuses.","md","\u002Fimages\u002Fnews\u002Fopenai-bug-bounty-172000.jpg",{},true,"\u002Fnews\u002Fopenai-bug-bounty-172000-chatgpt-codex-api",{"title":6,"description":105},"OpenAI more than quadrupled the midpoint of its bug bounty ranges. Critical ChatGPT, Codex and API bugs pay up to $30,000; exceptional ones up to $172,000 with quality, loyalty and campaign bonuses.","OpenAI bug bounty now pays up to $172,000","news\u002Fopenai-bug-bounty-172000-chatgpt-codex-api",[116,117,118,119,120],"openai","chatgpt","codex","security","bug-bounty","openai-bug-bounty-172000-2026-11","hNo0qaTA-X5KK8XAaECJ-Q41lpcz1rxuKdEokMsh_Jg",[124,129,135],{"title":125,"description":126,"path":127,"date":104,"image":128,"category":103},"EU court adviser: AI chatbots like Gemini can infringe press publishers' rights","On 3 November 2026, Advocate General Maciej Szpunar told the EU Court of Justice that a chatbot reusing news articles in its answers may infringe publishers' rights, while training on them is, as a rule, allowed.","\u002Fnews\u002Feu-court-adviser-gemini-chatbot-press-publishers-rights","\u002Fimages\u002Fnews\u002Fcjeu-gemini-press-publishers-rights.jpg",{"title":130,"description":131,"path":132,"date":133,"image":134,"category":103},"The New York Times sues Brave over AI scraping and its paywall blocker","On 2 November 2026, the New York Times and three other newspapers sued Brave Software, alleging it copies their journalism into its search index and sells it to AI companies through the Brave Search API, and that its browser bypasses paywalls.","\u002Fnews\u002Fnew-york-times-sues-brave-ai-scraping-search-api-paywall","2026-11-04T13:05:00","\u002Fimages\u002Fnews\u002Fnyt-sues-brave-ai-scraping.jpg",{"title":136,"description":137,"path":138,"date":139,"image":140,"category":103},"ChatGPT ads can now be bought through Magnite and PubMatic","OpenAI has signed Magnite and PubMatic as buying routes for ChatGPT ads, The Information reported on 2 November 2026. Advertisers set budgets, bids and creatives there; OpenAI still decides where ads appear.","\u002Fnews\u002Fchatgpt-ads-magnite-pubmatic-programmatic-buying","2026-11-04T13:00:00","\u002Fimages\u002Fnews\u002Fchatgpt-ads-magnite-pubmatic-programmatic.jpg",{"en":142,"fr":203,"es":8},{"id":5,"title":6,"author":7,"author_avatar":8,"body":143,"category":103,"date":104,"description":105,"extension":106,"image":107,"meta":200,"navigation":109,"path":110,"seo":201,"seoDescription":112,"seoTitle":113,"stem":114,"tags":202,"translationKey":121,"updatedAt":8,"__hash__":122},{"type":10,"value":144,"toc":194},[145,150,152,157,159,164,178,180,185,190,192],[13,146,15,147,24],{},[17,148,23],{"href":19,"rel":149,"target":22},[21],[26,151,29],{"id":28},[13,153,32,154,37],{},[17,155,36],{"href":19,"rel":156,"target":22},[21],[26,158,41],{"id":40},[13,160,44,161,48],{},[17,162,36],{"href":19,"rel":163,"target":22},[21],[50,165,166,170,174],{},[53,167,168,59],{},[56,169,58],{},[53,171,172,65],{},[56,173,64],{},[53,175,176,71],{},[56,177,70],{},[26,179,75],{"id":74},[13,181,78,182,37],{},[17,183,36],{"href":19,"rel":184,"target":22},[21],[13,186,84,187,37],{},[17,188,36],{"href":19,"rel":189,"target":22},[21],[26,191,91],{"id":90},[13,193,94],{},{"title":96,"searchDepth":97,"depth":97,"links":195},[196,197,198,199],{"id":28,"depth":97,"text":29},{"id":40,"depth":97,"text":41},{"id":74,"depth":97,"text":75},{"id":90,"depth":97,"text":91},{},{"title":6,"description":105},[116,117,118,119,120],{"id":204,"title":205,"author":7,"author_avatar":8,"body":206,"category":103,"date":104,"description":291,"extension":106,"image":107,"meta":292,"navigation":109,"path":293,"seo":294,"seoDescription":295,"seoTitle":296,"stem":297,"tags":298,"translationKey":121,"updatedAt":8,"__hash__":300},"news_fr\u002Ffr\u002Fnews\u002Fopenai-bug-bounty-172000-dollars-chatgpt-codex.md","OpenAI relève son bug bounty : jusqu'à 172 000 dollars pour les pires failles de ChatGPT",{"type":10,"value":207,"toc":285},[208,221,225,231,235,242,262,266,272,278,282],[13,209,210,211,215,216,220],{},"Le 2 novembre 2026, OpenAI a ",[17,212,214],{"href":19,"rel":213,"target":22},[21],"annoncé des récompenses plus élevées"," dans son programme Security Bug Bounty. L'entreprise dit « plus que quadrupler, en moyenne, le milieu de ",[217,218,219],"span",{},"ses"," fourchettes de récompense pour les failles moyennes, élevées et critiques ».",[26,222,224],{"id":223},"les-nouveaux-plafonds","Les nouveaux plafonds",[13,226,227,228,37],{},"Une vulnérabilité critique dans un produit central, ChatGPT, Codex ou l'API Platform, rapporte désormais jusqu'à 30 000 dollars. Les découvertes critiques exceptionnelles sur ces cibles restent éligibles jusqu'à 100 000 dollars, « et désormais jusqu'à 172 000 dollars avec les bonus » (",[17,229,36],{"href":19,"rel":230,"target":22},[21],[26,232,234],{"id":233},"trois-multiplicateurs","Trois multiplicateurs",[13,236,237,238,241],{},"OpenAI ajoute trois multiplicateurs à la prime de base (",[17,239,36],{"href":19,"rel":240,"target":22},[21],") :",[50,243,244,250,256],{},[53,245,246,249],{},[56,247,248],{},"Qualité :"," une preuve de concept fiable qui isole le bug, montre quand il est exploitable et démontre son impact.",[53,251,252,255],{},[56,253,254],{},"Fidélité :"," un programme à cinq niveaux pour les chercheurs qui signalent régulièrement des failles.",[53,257,258,261],{},[56,259,260],{},"Campagnes prioritaires :"," des enveloppes de bonus temporaires pour les nouvelles fonctionnalités.",[26,263,265],{"id":264},"ce-que-montrent-les-exemples","Ce que montrent les exemples",[13,267,268,269,37],{},"OpenAI a publié des calculs à titre illustratif. Une prise de contrôle de compte ChatGPT en un clic, autrefois récompensée 6 500 dollars, rapporterait aujourd'hui 51 577 dollars (30 000 × 1,15 qualité × 1,30 campagne prioritaire × 1,15 niveau de fidélité maximal). Une brèche majeure d'une frontière de sécurité, comme la lecture des messages ChatGPT de n'importe quel utilisateur, atteint 171 925 dollars (100 000 avec les mêmes multiplicateurs). Une faille moyenne payée 750 dollars passerait à 2 415 dollars (",[17,270,36],{"href":19,"rel":271,"target":22},[21],[13,273,274,275,37],{},"Les rapports pas encore récompensés bénéficient des nouvelles fourchettes. Pour les primes versées dans les 30 jours précédant l'annonce, OpenAI paiera la différence si la faille aurait rapporté plus (prime de base et bonus de fidélité). L'équipe sécurité sera aussi à PROMPT2PWN, à Oakland, les 20 et 21 novembre (",[17,276,36],{"href":19,"rel":277,"target":22},[21],[26,279,281],{"id":280},"pourquoi-cest-important","Pourquoi c'est important",[13,283,284],{},"ChatGPT et Codex contiennent désormais historiques de conversation, fichiers, code et comptes connectés pour un très grand nombre d'utilisateurs. L'exemple le plus cher retenu par OpenAI, lire les conversations des autres, est justement le risque qui inquiète le plus les utilisateurs. Mieux payer ces signalements donne aux chercheurs une raison de plus de les révéler en privé plutôt que de les vendre ou de les publier. Pour les équipes qui construisent sur l'API, c'est aussi un indice de la surface d'attaque qu'OpenAI juge la plus sensible.",{"title":96,"searchDepth":97,"depth":97,"links":286},[287,288,289,290],{"id":223,"depth":97,"text":224},{"id":233,"depth":97,"text":234},{"id":264,"depth":97,"text":265},{"id":280,"depth":97,"text":281},"Le 2 novembre 2026, OpenAI a augmenté les récompenses de son Security Bug Bounty. Une faille critique dans ChatGPT, Codex ou l'API rapporte jusqu'à 30 000 dollars, et une découverte exceptionnelle jusqu'à 172 000 dollars avec les nouveaux bonus.",{},"\u002Ffr\u002Fnews\u002Fopenai-bug-bounty-172000-dollars-chatgpt-codex",{"title":205,"description":291},"OpenAI a plus que quadruplé le milieu de ses fourchettes de récompense. Faille critique ChatGPT, Codex ou API : jusqu'à 30 000 dollars ; exceptionnelle : jusqu'à 172 000 dollars avec bonus.","Bug bounty OpenAI : jusqu'à 172 000 dollars par faille","fr\u002Fnews\u002Fopenai-bug-bounty-172000-dollars-chatgpt-codex",[116,117,118,299,120],"securite","0l06-KN4_yfx_siN0Tzl_KPUYP16l2vmZqrQGkJkcS4"]