OpenAI raises bug bounty payouts to as much as $172,000 and plans a new security sprint with Cathedral

OpenAI has announced two security measures in quick succession: a large increase in what it pays outside researchers who report vulnerabilities, and a second internal "security sprint" that will bring in the security firm Cathedral. Both were described in company blog posts and summarized by The Decoder, Help Net Security and Unite.AI.

Higher rewards for outside researchers

According to the reports, the midpoint of OpenAI's reward ranges for medium, high and critical findings has more than quadrupled on average. A critical vulnerability in one of the company's core products, which it lists as ChatGPT, Codex and the API Platform, can now earn up to $30,000. Findings OpenAI judges exceptional can reach $100,000 in base reward, and about $172,000 once bonuses are added.

Those bonuses come from several new mechanisms. Reports with a reliable proof of concept that isolates the bug and demonstrates its impact qualify for a quality multiplier. A five-tier loyalty program adds growing bonuses for researchers who keep working with the company, and time-limited campaigns will offer dedicated bonus pools for testing newly launched features. Reports still awaiting a decision will be paid under the new ranges, and researchers awarded in the 30 days before the change will receive the difference if the new scale would have paid more.

The Decoder notes that the new ceiling puts OpenAI in the range of Google's general vulnerability rewards, but still below the top payouts Apple and Microsoft offer for operating-system exploits.

A second sprint, with outside help

OpenAI also says it is preparing another concentrated effort to stress-test its own systems. Cathedral researchers are to use OpenAI's models alongside internal teams to probe defenses. Unite.AI stresses that this is a planned exercise, not completed testing.

The company has shared figures from the previous sprint, which it calls the Defense Factory. About a quarter of its product engineers took part, with Codex used to reproduce reported flaws in isolated environments and prepare patches for human review. Unite.AI reports that 53 urgent or high-priority issues were closed on day one, that 37% of findings were duplicates and that 0.53% of fixes were rolled back. Follow-up checks also found a gap between patches being merged and fixes actually reaching the whole fleet.

What is not yet known

The reports do not give the previous reward amounts in detail, the thresholds for each loyalty tier or a date for the new sprint. Most figures come from OpenAI itself and have not been independently audited.