OpenAI Plans New Security Sprint and Raises Bug Bounty Rewards

PUBLISHER ARTICLE PREVIEW

From the original article

OpenAI announced on November 2, 2026 that it is planning another internal security sprint with Cathedral and other outside researchers, while a same-day bug-bounty update raised rewards and introduced bonuses that can lift exceptional critical payouts to $172,000.

Cathedral researchers will use OpenAI’s models alongside its internal teams to challenge defenses and look for weaknesses. The announcement concerns a planned sprint, not a completed round of testing. Gavin Kliger, Cathedral’s CEO and co-founder, said the collaboration would pair OpenAI’s models and security expertise with Cathedral’s research to find weaknesses, test fixes and support continuous defense.

The changes more than quadrupled the midpoint of reward ranges for medium, high and critical findings on average, according to OpenAI’s separate bug-bounty announcement. A critical vulnerability in a core product such as ChatGPT, Codex or the API Platform can now earn up to $30,000. Exceptional critical findings on those targets remain eligible for up to $100,000 before bonuses.

High-quality reports will be eligible for a multiplier on the base bounty. The quality bonus recognizes a reliable proof of concept that isolates the bug, shows when it can be exploited and demonstrates its impact.