OpenAI published two security posts on November 2, 2026. The first says it is planning its next internal security sprint, this time with an outside firm, Cathedral, whose researchers will use OpenAI’s models alongside OpenAI’s own teams to attack its systems. The second raises the rewards in its Security Bug Bounty program.
The headline number: “A critical vulnerability in a core product such as ChatGPT, Codex, or the API Platform will now earn up to $30,000.” Exceptional critical findings can still earn up to $100,000, and now up to $172,000 with the new bonuses. OpenAI says it is “more than quadrupling the midpoint of our reward ranges for medium, high, and critical findings on average.”
Below: how OpenAI’s defense loop works, the new payouts in OpenAI’s own examples, and what the two posts leave out.
On this page · 7 sectionsOpen
OpenAI raised its Security Bug Bounty on November 2, 2026, more than quadrupling the midpoint of its reward ranges for medium, high and critical findings.
A critical bug in ChatGPT, Codex or the API Platform now earns up to $30,000; exceptional findings up to $172,000 with bonuses.
Its next internal security sprint adds Cathedral, whose researchers will use OpenAI’s models to attack OpenAI’s systems.
The last sprint put 25% of OpenAI’s product engineers on finding and fixing weaknesses, with Codex reproducing bugs and drafting patches.
Pending reports get the new ranges, and bounties paid in the prior 30 days are topped up to the difference.
§ 01How OpenAI’s defense loop works
The sprint post describes what the last one looked like: “We dedicated 25% of our product engineers to finding and fixing weaknesses in our systems.” Using Codex, engineers investigated findings, reproduced vulnerabilities in isolated environments and prepared patches for review. OpenAI calls this its Defense Factory work.
The next sprint adds outside eyes. Cathedral’s researchers will bring “differentiated expertise and approaches to finding weaknesses,” in OpenAI’s words, and the bug bounty pays independent researchers for what both miss. Cathedral’s CEO, Gavin Kliger, put the case for other companies: “Every company should be thinking about how to put these capabilities to work.”
OpenAI’s reason is blunt: “traditional cyber defenses alone are no longer sufficient.” The post adds that “Recent incidents across the industry show how quickly threats can emerge,” and the same day WorkOS disclosed a breach it tied to an AI agent framework (see our record of the WorkOS ARTEX breach).
§ 02The new payouts, in OpenAI’s own examples
OpenAI’s bounty post works through four example findings, comparing a past award with what the same finding would earn under the new rules. OpenAI notes: “All scenarios and historical awards are illustrative.”
| Example finding | Past award | New calculation | New reward | Multiple |
|---|---|---|---|---|
| Medium, ChatGPT: a read-only member can upload files to a Project | $750 | $2,000 x 1.15 quality x 1.05 Bronze loyalty | $2,415 | 3.2x |
| High, Prism (non-core): reading another user’s Project file | $1,000 | $2,500 x 1.15 quality x 1.10 Gold loyalty | $3,162.50 | 3.2x |
| Critical, ChatGPT: one-click account takeover | $6,500 | $30,000 x 1.15 quality x 1.30 priority campaign x 1.15 top loyalty tier | $51,577 | 7.9x |
| Exceptional, ChatGPT: viewing any user’s chat messages | $100,000 | $100,000 x 1.15 x 1.30 x 1.15 | $171,925 | 1.7x |
The biggest jump is in the middle of the scale. A critical bug like a one-click account takeover now pays about eight times its old example award; the exceptional tier was already at $100,000 and gains only through the multipliers.
§ 03The new bonuses
- Quality multiplier. A report with a reliable proof of concept that isolates the bug, shows when it can be exploited and demonstrates impact earns a bonus on the base bounty.
- Loyalty tiers. A five-tier program pays scaling bonuses to researchers who keep reporting.
- Priority campaigns. Short campaigns with dedicated bonus pools for newly launched features.
- Back pay. Reports still awaiting a bounty get the new ranges, and bounties awarded in the 30 days before the announcement are topped up to the difference.
OpenAI’s security team will also be at PROMPT2PWN in Oakland on November 20 and 21, where researchers can test targets in person.
§ 04What the posts do not say
- Cathedral. Nothing about the firm beyond its CEO’s quote, and no start date for the sprint.
- Results. No count of what the last sprint found or fixed.
- The full table. The new ranges for every severity live on the program page, not in the post.
- Low severity. The quadrupling covers medium, high and critical findings only.
§ 05What this means for a small software team
OpenAI can put a quarter of its product engineers on security for a sprint and pay about $50,000 for a single account takeover. A ten-person company cannot. What it can copy is the loop: use the same models to look for weaknesses in your own code, reproduce each finding before trusting it, and have a person review every fix before it ships.
Our position, declared: we build CellCog, where AI employees write and ship code for small teams, so the review step is the part we care about most. Every command an AI employee runs is classified before it runs, and anything above the owner’s chosen level waits for a human yes. For how OpenAI hardens its own training environment, see our record of OpenAI’s training containment.
§ 06What we are watching
- The sprint’s results. Whether OpenAI publishes what Cathedral and its teams found, as it did with the Brotli flaw in October.
- Payout data. Whether bounty payouts rise in OpenAI’s next disclosures.
- Other labs. Whether Anthropic or Google raise their own bounty ranges in response.
§ 07Sources
- OpenAI: Preparing our next security sprint to harden OpenAI, November 2, 2026, read the same day.
- OpenAI: Rewarding defenders with bigger bug bounties, November 2, 2026.
- OpenAI on X: announcement post, November 3, 2026 (UTC).
Q1When did OpenAI raise its bug bounty?
On November 2, 2026, in a post on openai.com, announced on X early on November 3 UTC.
Q2What are the new bonuses?
A quality multiplier for strong proofs of concept, a five-tier loyalty bonus, and priority campaign multipliers for newly launched features.
Q3Who is Cathedral?
A security firm whose researchers will use OpenAI’s models alongside OpenAI’s teams in the next sprint. Its CEO and co-founder is Gavin Kliger.
Q4How did OpenAI's last security sprint work?
OpenAI dedicated 25% of its product engineers to it; using Codex, they investigated findings, reproduced bugs in isolated environments and prepared patches for review.
Q5Where can researchers meet OpenAI's security team?
At PROMPT2PWN in Oakland on November 20 and 21, 2026, where researchers can test targets in person.