OpenAI announced on November 2 that it is raising its Security Bug Bounty rewards and planning another internal security sprint, this time with outside researchers from Cathedral Systems working alongside its own teams and using OpenAI's models to challenge its defences. Cathedral CEO Gavin Kliger said the collaboration pairs OpenAI's models and security expertise with Cathedral's research to find weaknesses, test fixes and support continuous defence. The sprint is planned, not completed — no start date or targets have been announced.

The money is concrete. A critical vulnerability in a core product such as ChatGPT, Codex or the API Platform now earns up to $30,000; exceptional critical findings remain eligible for up to $100,000 before bonuses, and new multipliers — up to 1.15x for report quality, 1.30x for priority campaigns and a 5–15% loyalty bonus — can lift an exceptional payout to about $172,000. OpenAI says the midpoint of its reward ranges for medium, high and critical findings has more than quadrupled on average.

The new ranges apply generously in transition: reports still awaiting an award will be paid at the new rates, and researchers whose bounties were awarded in the 30 days before the announcement will receive the difference where the new rates pay more. In its previous sprint OpenAI dedicated 25% of its product engineers to finding and fixing weaknesses, using Codex to reproduce findings and draft patches. Jailbreaks and prompt-only safety bypasses remain out of scope for the bounty.