Pay by program (checked 26 Oct 2026)
| Program | Run by | What it pays | What it wants | Where you apply |
|---|---|---|---|---|
| Google AI Vulnerability Reward Program | $20,000 for rogue-action attacks on flagship products, $15,000 for sensitive-data exfiltration, $100–$5,000 for lesser classes, times 0.8–1.2 for report quality, plus $1,000–$5,000 novelty bonuses (rules) Verified | Security flaws in AI features, such as indirect prompt injection that makes Gemini or Gmail act without the user's confirmation | Google Bug Hunters | |
| OpenAI Safety Bug Bounty | OpenAI, on Bugcrowd | Up to $7,500 per report (OpenAI) Verified; trackers list P1 $5,500–$7,500, P2 $2,500–$3,500, P3 $750–$1,500, P4 $250–$500 (Real Cutoff) Self-reported | Abuse and safety issues in agentic products (ChatGPT Agent, Atlas, Codex, connectors and MCP), hidden-reasoning leaks, account and platform integrity bypasses | Bugcrowd |
| Gray Swan Arena | Gray Swan, with frontier labs and AI safety institutes | Prize pools: $40,000 in its Q1 2026 challenge (minimum payout $100), $30,000 in August 2026, and a listed $300,000 pool for October 2026's "IPI Black" challenge (Arena) Verified | Jailbreaks and prompt injections against models in timed challenges, ranked on leaderboards | Gray Swan Arena |
The two bounties and the competitions work differently. A bounty pays the first person to report each valid issue, whenever they find it. A competition pays leaderboard ranks and per-model pools during a set window, so you're racing other people at the same time.
What actually gets paid
Real impact on real products. Google pays for AI bugs where interacting with a model is integral to the flaw: an attacker's text hidden in an email or web page that hijacks an assistant into taking an action or leaking private data. OpenAI's bounty covers similar third-party prompt injection against its agents, and it says the attack must reproduce at least 50% of the time.
Clear reports with a fix. OpenAI asks for reproducible steps and a suggested remediation, and Google adjusts its reward by report quality. A finding nobody can reproduce earns nothing.
What doesn't
- Plain jailbreaks. OpenAI says jailbreaks are out of scope for its Safety Bug Bounty, and that getting the model to use rude language doesn't count. Google's AI program excludes jailbreaks, hallucinations, harmful-content outputs and system-prompt leaks. Gray Swan's competitions are the place where jailbreak skill is paid.
- Duplicates. Only the first report of an issue is rewarded, on both bounties.
- Testing on other people. Both programs require you to use accounts you own. Never aim an attack at real users' agents.
What it adds up to
This is not steady income. One tracker of OpenAI's Bugcrowd page counted only 11 rewarded reports since July 2025, with an average award of $812.50 Self-reported. Google said its programs had paid over $430,000 for AI-related bugs before the dedicated AI program launched in October 2025 (Infosecurity Magazine) Self-reported. Spread across every researcher who tried, most people earned little or nothing.
A worked example Estimate: if you spend 10 hours a week for three months and land one accepted P3 report on OpenAI's table, that's $750 to $1,500 for roughly 130 hours, or about $6 to $12 an hour. One accepted Google rogue-action bug in the same period would be worth far more. The skill is the asset; the payouts are uneven.
Who it suits
Good fit: you already do web security or penetration testing, you understand how agents read untrusted content (emails, pages, files), and you enjoy writing careful reports. Gray Swan's challenges are the lowest-barrier entry, since most winning breaks are written in plain English.
Poor fit: you need predictable money each month, or you're hoping to get paid for jailbreak screenshots. Those are explicitly excluded from the bounties.
How to start
- Practice in a competition first. A Gray Swan challenge teaches prompt injection with a scoreboard and no need to write formal reports. See AI red-teaming competitions.
- Read one program's rules end to end. Scope lists change, and out-of-scope findings are the most common way to waste a week.
- Set up test accounts you own. Note that testing some OpenAI agentic products can need a paid ChatGPT plan, and the program doesn't reimburse upgrades.
- Write reports like a bug ticket. Steps, expected versus actual behavior, real-world impact and a proposed fix.
Our research notes cover each route in detail: Google AI VRP bug bounties and OpenAI's Safety Bug Bounty.
FAQ
How much does OpenAI's bug bounty pay for AI safety issues?
OpenAI's Safety Bug Bounty pays up to $7,500 per accepted report. Trackers of its Bugcrowd page list four paid tiers, from $250–$500 at the lowest to $5,500–$7,500 at the top, and OpenAI decides the final amount.
Does Google pay for AI bugs?
Yes. Google's AI Vulnerability Reward Program lists up to $20,000 for rogue-action attacks on flagship AI products such as Search, the Gemini apps and core Workspace, $15,000 for sensitive-data exfiltration, and $100–$5,000 for lesser issues, adjusted for report quality.
Do jailbreaks count for AI bug bounties?
Generally no. OpenAI's Safety Bug Bounty and Google's AI VRP both exclude jailbreaks. Red-teaming competitions such as Gray Swan Arena are where jailbreaks and prompt injections can win prizes.
Do you need to be a security expert?
For the Google and OpenAI bounties, it helps a lot: rewards go to reproducible, high-impact findings with clear reports. Gray Swan's competitions are more beginner-friendly, since most winning breaks are written in plain English.
Is AI bug bounty income reliable?
No. You're paid only for accepted, first-reported findings, and one tracker counted just 11 rewarded reports on OpenAI's safety program since July 2025. Treat it as occasional income on top of other work.