OpenAI is paying outside researchers far more to break its own systems before attackers do, pairing a sharply raised bug bounty with a new internal security sprint that brings outside researchers in to test its defences. The company said on 2 November that a critical flaw in a core product can now earn up to $30,000, with exceptional findings eligible for up to $172,000 once bonuses stack. Cathedral researchers will use OpenAI’s models alongside its own teams in the next sprint, though no start date for that exercise has been given.
The new bounty maths
OpenAI says it has more than quadrupled, on average, the midpoint of its reward ranges for medium, high and critical findings. A critical vulnerability in ChatGPT, Codex or the API Platform now earns up to $30,000. Exceptional critical findings on those core products remain eligible for up to $100,000 before bonuses are applied.
The headline $172,000 figure is therefore a ceiling reached only when several bonuses combine, not the standard payment for a critical report. That distinction matters for researchers weighing whether to spend days on a difficult target: the base payment, not the ceiling, is what most serious reports will actually earn.
The bonuses stack multiplicatively. A high-quality report, meaning one with a reliable proof of concept that isolates the bug and shows its impact, can earn a 1.15 multiplier. A new five-tier loyalty programme adds scaling bonuses for repeat researchers, with the examples given ranging from 1.05 for Bronze to 1.15 for the top 31337 tier.
Short priority campaigns for newly launched features add a further 1.30 multiplier and their own bonus pools. OpenAI’s own worked example shows how the ceiling is reached: a $100,000 exceptional finding multiplied by 1.15 for quality, 1.30 for a priority campaign and 1.15 for loyalty totals $171,925, which the company rounds to $172,000.
The post also applies the new ranges retroactively in part. Reports already submitted but not yet awarded will use the new ranges. Awards made in the 30 days before the announcement will be topped up if they would have earned more under the new terms.
Cathedral joins the next sprint
The second announcement covers the planned sprint itself. OpenAI says Cathedral’s researchers will work alongside its own teams, using its models to challenge its defences and help test fixes. Cathedral chief executive Gavin Kliger said the work would combine OpenAI’s models and security expertise with Cathedral’s research.
OpenAI presents the partnership as a way to keep testing its systems continuously rather than in occasional bursts. The sprint builds on an earlier exercise in which OpenAI dedicated a quarter of its product engineers to finding and fixing weaknesses, using Codex to investigate findings and reproduce vulnerabilities in isolated environments.
OpenAI has not said how many engineers that quarter represented, how long the earlier sprint lasted, or how many findings or patches it produced. Those gaps mean the earlier sprint’s success is asserted rather than demonstrated, and the new sprint will be judged on the findings it eventually discloses.
The defender’s window
OpenAI frames both moves around what it calls the defender’s window: the idea that defenders can point the most capable models at their own code before attackers gain similar power from openly available models. It argues that traditional cyber defences alone are no longer sufficient, pointing to recent incidents across the industry.
Beyond its own systems, OpenAI says it has committed $1 billion in subsidised access over six months for frontline defenders protecting essential services and digital infrastructure, delivered through its Daybreak customers. It also says it is sharing the architecture and lessons from its last sprint, alongside a blueprint for cyber defenders.
No eligibility process, allocation breakdown or start date for that commitment was given. That leaves the $1 billion figure as a promise of access rather than a programme researchers or defenders can yet apply to, and its value will depend on how the access is actually distributed.
Why It Matters
The bounty rise matters because it changes the economics of disclosure for the researchers most likely to find serious flaws in widely used AI systems. A flaw in ChatGPT or the API Platform can affect millions of users at once, so paying more for a quiet, well-documented report is cheaper than cleaning up after a public exploit.
The loyalty and quality bonuses also reward the researchers who return repeatedly with reproducible work, rather than one-off submissions. That preference should improve the signal OpenAI receives: fewer vague tips, and more reports its engineers can reproduce, verify and fix quickly.
The timing matters too. Rival labs and security firms are racing to build the same capability, with agent-security products such as CrowdStrike’s kill switch for rogue agents arriving the same week. OpenAI’s sprint is therefore as much a competitive signal as a technical exercise: it wants the best outside testers working on its systems first.
Our read
Read together, the two posts show OpenAI treating its own products as a live attack surface rather than a finished fortress. That is a healthy instinct, and the retroactive top-ups suggest the company is serious about keeping researchers on its side. But the announcements are plans and prices, not results.
No sprint date, no targets, no findings and no patch counts have been disclosed, so the real test will be what the sprint actually finds and fixes. The $172,000 figure also deserves a cooler reading than the headline suggests, since it requires an exceptional finding plus every bonus at once, which few reports will achieve.
The more meaningful change for most researchers is the higher base payment and the quality multiplier, which reward careful, reproducible work. OpenAI’s own history points the same way: it rebuilt its Git backend after its agents broke it, a reminder that the sharpest pressure on its systems now comes from its own tools.
Background
Bug bounty programmes invite outside researchers to probe a company’s systems under agreed rules and report what they find for a reward, instead of selling the flaw or publishing it. As AI models grow better at finding vulnerabilities themselves, labs have increasingly turned that capability inward, hiring outside red teams to attack their own defences first.
Source: bounty update and sprint plan.
0 Comments