OpenAI plans an AI-run security sprint with Cathedral and more than quadruples critical bug bounties

What OpenAI announced

OpenAI published two related announcements on November 2: a plan for its next internal security sprint, this time with an outside partner, and a substantial overhaul of its Security Bug Bounty rewards. Together they describe a strategy of continuous, AI-assisted defense, where finding weaknesses and verifying fixes is ongoing work rather than a periodic assessment.

The sprint will pair OpenAI's own teams with researchers from Cathedral Systems, a security firm whose CEO and co-founder is Gavin Kliger. Cathedral researchers will use OpenAI's models alongside company staff to challenge existing defenses. OpenAI said the collaboration would combine differentiated expertise and approaches, but did not give a start date, a target list, or findings from the upcoming sprint.

The announcement frames this as a response to a changing threat environment. OpenAI says traditional cyber defenses are no longer sufficient, and that recent incidents across the industry show how quickly threats emerge. The approach builds on the company's earlier disclosure of what it calls its Defense Factory architecture. For more on how frontier labs are formalising AI security work, see our report on Anthropic's three-tier Cyber Verification Program.

What the previous sprint showed

OpenAI's first disclosed sprint dedicated 25 percent of its product engineers to finding and fixing weaknesses in its systems. Engineers used Codex to investigate findings, reproduce vulnerabilities in isolated environments, and prepare patches for review. The published Defense Factory architecture describes the workflow: agents map systems, investigate possible flaws, confirm whether issues can be reproduced, identify responsible teams, and prepare tested fixes.

The company also published lessons from that early testing. Duplicate findings slowed review, severity ratings needed clearer instructions, and missing dependencies made some tests difficult to run. Follow-up checks exposed another gap: a merged patch did not always mean the fix had reached every deployed system, so human review and independent checks remain part of the workflow.

OpenAI says it is making its most capable models available to Daybreak customers, its program for frontline defenders, and has committed $1 billion in subsidized access over six months for organizations protecting essential services and digital infrastructure.

How the bug bounty is changing

The bounty overhaul is the more concrete part of the announcement. OpenAI says it is more than quadrupling the midpoint of its reward ranges for medium, high, and critical findings on average. A critical vulnerability in a core product such as ChatGPT, Codex, or the API Platform now earns up to $30,000, up from a historical example of $6,500 for a one-click account takeover. Exceptional critical findings remain eligible for a base award of up to $100,000, and now up to $172,000 with bonuses.

New incentives sit on top of the base amounts. A quality multiplier rewards reports that include a reliable proof of concept isolating the bug, showing when it can be exploited, and demonstrating its impact. A five-tier loyalty bonus program provides scaling bonuses for researchers who consistently report findings, from a Bronze tier up to a 31337 tier in OpenAI's example. Priority campaigns add dedicated bonus pools for newly launched features.

OpenAI's illustrative payout table shows how the multipliers stack. The company is explicit that the scenarios and historical awards are illustrative, not a promise of specific payouts.

Under the new ranges, a critical ChatGPT one-click account takeover computes to $51,577 with a quality bonus, priority campaign bonus, and the top 31337 loyalty tier, and an exceptional finding that could view arbitrary ChatGPT users' chat messages computes to $171,925, up from a $100,000 historical award.

The changes are retroactive. Researchers who already submitted reports get the new ranges applied, and the company will pay the difference for bounties awarded in the 30 days before the announcement if the finding would have earned more under the new rates. OpenAI's security team will also be at PROMPT2PWN in Oakland on November 20-21. For a recent example of how attacker tools are evolving, see our report on SOCRadar's analysis of a Claude Code agent campaign.

Why the reward structure matters

The numbers signal how OpenAI values specific bugs. The jump from $6,500 to $30,000 for a critical ChatGPT or Codex vulnerability is a direct read on what a one-click account takeover is worth to the company, and the $172,000 exceptional ceiling prices a full security-boundary compromise, such as viewing arbitrary users' chat messages. The tiered loyalty and priority bonuses are designed to keep a stable community of researchers focused on the newest features, when bugs are most likely to be fresh.

OpenAI's argument is that defensive AI at frontier level is now a continuous loop: agents find weaknesses, engineers reproduce and patch them, and outside researchers check the work. The company acknowledges the loop is imperfect, citing the merged-patch gap from its own first sprint. That admission keeps the announcement honest about the limits of the approach, even as OpenAI positions AI-assisted defense as the only viable path against increasingly capable attackers.