OpenAI Raises Bug Bounty Rewards and Plans Another Internal Security Sprint

OpenAI has announced two security measures in separate posts. The first raises the rewards in its Security Bug Bounty program, which pays independent researchers who report vulnerabilities in OpenAI software. The second says OpenAI is preparing its next internal security sprint, this time with an outside partner called Cathedral. Both posts carry a 2 November 2026 date in OpenAI's news feed.[1][2]

OpenAI frames both steps as one effort to use AI to keep finding and fixing weaknesses in its own systems. The company says traditional cyber defences alone are no longer enough. It points to recent incidents across the industry as proof that threats can emerge quickly.[2]

OpenAI says it is more than quadrupling, on average, the midpoint of its reward ranges for medium, high and critical findings. A critical vulnerability in a core product such as ChatGPT, Codex or the API Platform now earns up to $30,000. Exceptional critical findings on those targets remain eligible for up to $100,000, and up to $172,000 once bonuses apply.[1]

The post adds three bonus schemes. A quality multiplier rewards reports with a reliable proof of concept. A five-tier loyalty system rewards researchers who report repeatedly. Priority campaigns open short-term bonus pools for newly launched features. OpenAI says unpaid reports will be assessed under the new ranges, and awards paid in the previous 30 days will be topped up if the new ranges would have paid more.[1]

OpenAI gives four worked examples and labels all of them illustrative. A medium finding in ChatGPT, where a read-only member can upload files without write permission, once earned $750 and would now earn $2,415. A one-click account takeover once earned $6,500 and would now earn $51,577 with every multiplier applied.[1]

The examples show that most of the headline gain comes from stacked multipliers, not from the base reward alone. A researcher should read the full terms on OpenAI's Bugcrowd page before relying on any figure. OpenAI also says its security team will attend PROMPT2PWN in Oakland on 20 and 21 November 2026, where researchers can test targets in person.[1]

OpenAI says its last sprint put 25% of its product engineers on finding and fixing weaknesses. Engineers used Codex to investigate findings, reproduce vulnerabilities in isolated environments and prepare patches for review. For the next sprint, Cathedral's researchers will use OpenAI's models alongside OpenAI's teams to challenge its defences.[2]

The sprint post also repeats earlier OpenAI commitments. It says OpenAI has committed $1 billion in subsidised access over six months for frontline defenders protecting essential services and digital infrastructure, through its Daybreak program. OpenAI links to its own account of the last sprint and a blueprint for cyber defenders. We did not read those linked pages.[2]