OpenAI More Than Quadruples Its Bug Bounties, With Critical Flaws Now Worth Up to $30,000, and Invites Cathedral Systems to Attack It

OpenAI is rewriting the economics of reporting a flaw in its products. In two posts published on 2 November, the company said it is more than quadrupling the median payout across its middle, high and critical severity tiers, and confirmed that it has begun planning its next internal "security sprint" with Cathedral Systems, an outside security firm whose researchers will use OpenAI's own models to probe OpenAI's own defenses.

The bounty numbers are specific. A medium-severity finding moves from $750 to $2,000, a high from $1,000 to $2,500, and a critical from $6,500 to a ceiling of $30,000. The top "exceptional critical" tier keeps its $100,000 base, but bonuses stack on top of it: 1.15x for a report with a working proof of concept, up to 1.15x for researcher loyalty across a five-tier ladder, and 1.30x for findings inside a time-limited priority campaign. OpenAI's own worked example, a one-click account takeover in ChatGPT, lands at $51,577 on the critical tier and $171,925 at the exceptional tier.

Scope matters here. The core assets are ChatGPT, Codex and the API platform; a non-core property such as Prism pays less. Reports still sit on Bugcrowd. The company is also back-paying: submissions that were queued but unpaid when the policy changed move to the new ranges, and anything paid out in the previous 30 days is topped up if the new schedule would have paid more. Researchers who want to test in person can do so at PROMPT2PWN in Oakland on 20 and 21 November, where OpenAI's security team will be on site.

The second post explains why the cheque book opened. In the previous sprint, OpenAI put a quarter of its product engineers on vulnerability hunting, with Codex used to investigate reports, reproduce bugs inside isolated environments and draft patches for review. That exercise turned up process failures as much as code failures: duplicate submissions clogged triage, severity grading needed clearer rules, and some tests could not run because of missing dependencies. The most consequential finding was that merging a patch does not mean every deployed system is fixed, which is why human review and independent verification stay in the loop.

Cathedral Systems joins that loop from the outside. Its researchers will work alongside OpenAI staff, using OpenAI's models to challenge the defenses and then to test whether the fixes hold. "OpenAI is setting an important example by partnering with outside security firms and using its own models to continuously test and strengthen its defenses," said Cathedral chief executive and co-founder Gavin Kliger, who argued every company should be thinking about how to put these capabilities to work. Cathedral drew attention earlier this year when it said it had broken into Anthropic's systems, a claim reported by the Washington Post that Anthropic did not confirm.

The bounty increase is tied to Daybreak, the program through which OpenAI gives frontline defenders access to its strongest models. The company reiterated a commitment to subsidise $1 billion of that access over six months for organisations protecting critical services and digital infrastructure, pairing cheap model access with the cash rewards.

The strategic logic is not complicated. If models can find and exploit weaknesses faster than humans can patch them, then the cheapest defense is to make disclosure worth more than exploitation, and to keep the offensive research inside a structure where the findings come back. What OpenAI has not disclosed is the scale of the problem it is defending against: no figures on submissions received, total bounties paid, or the number of incidents that prompted the sprint. Both posts cite "recent incidents across the industry" without naming one.

For the wider market, the signal is that AI vendors are starting to budget for security the way cloud providers did a decade ago, with external red teams, tiered payouts and public post-mortems as standard furniture. The open question is whether that spending is calibrated to the risk or to the headlines, and whether a vendor that both builds the attack model and pays the attacker can credibly grade its own homework.