OpenAI plans new security sprint with Cathedral and raises bug bounties to $172,000 with bonuses

On 2 November 2026 OpenAI published two related blog posts: 'Preparing our next security sprint to harden OpenAI' and 'Rewarding defenders with bigger bug bounties'. The first announces a new internal security sprint in which OpenAI brings external researchers and security partners together with its own teams, in order to test and strengthen its systems with its own models. The second raises the rewards in the Security Bug Bounty program, so that independent researchers find vulnerabilities that its own testing may have missed.

This article sets out both announcements. You can read what the sprint involves, what role Cathedral plays in it (partner, not an acquisition), what the previous sprint delivered, how the Daybreak program with $1 billion in subsidized access fits into that story, and what the new bounty amounts and bonuses concretely mean for you if you investigate vulnerabilities yourself or manage a security team. Where OpenAI calculates with bonuses, the worked examples the company itself provides are set out below.

Two announcements, one message

The two posts are not separate from each other. The sprint is about finding and fixing weak spots internally with the help of models; the bounty program is about doing the same with help from outside. OpenAI describes the latter as a complement to the work of the 'Defense Factory', where engineers use models to trace weaknesses, reproduce them and test fixes. Responsible disclosure by external researchers runs alongside that, according to the company.

If you follow the broader development, you see that labs are increasingly organizing their defense as a continuous process instead of a periodic audit. For background on that shift you can turn to our dossier on AI and cybersecurity, which focuses on the interplay between attack and defense tooling. That helps to put the two announcements in perspective: they are not loose news items, but two knobs on the same instrument.

In the sprint post OpenAI writes that 'traditional cyber defenses alone are no longer sufficient' and that recent incidents across the industry show how quickly threats can emerge. The company draws the conclusion that organizations need 'continuous defensive loops' to find and fix weaknesses before attackers do. That formulation is the core of both posts.

The next security sprint

OpenAI describes the coming sprint as a period in which it brings 'new researchers and security partners together with our own teams', with the goal 'to use our models to test and strengthen our systems'. So it is explicitly an internal sprint – its own systems are the target – for which extra people and partners are brought in temporarily.

"We're partnering with Cathedral, whose researchers will use OpenAI's models alongside our teams to challenge our defenses, bringing differentiated expertise and approaches to finding weaknesses and helping us protect our platforms."

That wording is exactly as OpenAI writes it: Cathedral researchers work alongside its own teams, with its own models, to challenge the defense. The idea behind it is that an outsider asks different questions and walks different paths than the team that built the system. For defenders that is a familiar pattern: your own assumptions are hardest to question when you wrote them yourself. If you want to know how you select such models and what to watch for in code audits, you can find starting points in this comparison of models for cybersecurity and code audits.

OpenAI says in addition that it is 'sharing our architecture and lessons from the last sprint, alongside our blueprint for empowering cyber defenders across industry and government'. That means part of the knowledge gained does not stay behind the front door, but is published as a blueprint for other defenders. For IT teams that want to start such loops themselves, that is relevant material.

Cathedral as partner, not an acquisition

It is important to keep this sharp: OpenAI is entering into a partnership with Cathedral. There is no acquisition, no purchase and no takeover. Cathedral remains an independent security firm; OpenAI brings the researchers into the sprint temporarily to test its own defenses. The word OpenAI itself uses is 'partnering'.

Gavin Kliger, CEO and co-founder of Cathedral, says about it:

"OpenAI is setting an important example by partnering with outside security firms and using its own models to continuously test and strengthen its defenses. Every company should be thinking about how to put these capabilities to work. We're excited to collaborate with OpenAI's teams, combining their models and security expertise with our research to find weaknesses, test fixes and strengthen this approach to continuous defense."

That quote contains the broader claim both parties share: not only OpenAI should work this way, but every organization. Whether that is feasible for your organization depends on scale and maturity. An overview of parties that offer services in this area can be found in this overview of AI security companies, useful if you want to determine whether you do this yourself or outsource it.

What you can take from this construction is the division of roles. An external party with a different view, linked to the models and the system knowledge of your own team, and an explicit goal: finding weak spots, testing fixes and making the approach repeatable. That last part – actually testing fixes – is often skipped.

What the previous sprint delivered

In the sprint post OpenAI looks back at the previous round. In it, the company dedicated 25% of its product engineers to finding and fixing weaknesses in its own systems. Using Codex, engineers investigated findings, reproduced vulnerabilities in isolated environments and prepared patches for review.

That combination is worth mentioning: reproducing in an isolated environment and preparing patches for human review. It is the same discipline you expect from a good external report – a finding is only usable if someone else can reproduce it and establish the impact. How you approach that on the defender's side, with repeatable tests, is described in red teaming and security tests.

OpenAI also explicitly calls the sprint an ongoing effort: using AI to continuously find and fix weaknesses is not a campaign with an end date, but a cycle. For your own team that concretely means thinking about cadence: how often do you run through the loop, who assesses the findings, and how do you ensure that a weak spot that is found actually disappears instead of ending up on a list.

Daybreak: $1 billion in subsidized access

In the same vein OpenAI mentions Daybreak. The company uses its most capable models to strengthen its own defenses and makes those models available to Daybreak customers. That comes with a commitment of $1 billion in subsidized access over a period of six months, intended for 'frontline defenders protecting essential services and digital infrastructure'.

That amount is a commitment of subsidized access, not a revenue figure and not an investment round. It mainly says something about the assumption that precisely the parties protecting essential services and digital infrastructure benefit from access to this type of model, but cannot always afford that access themselves. For organizations in that category it is worth checking whether you fall under that arrangement.

At the same time, model access alone is not a defense. You need people who assess findings, and processes that ensure a report also leads to a fix. If you work with agents that carry out tasks on systems autonomously, it is wise to follow developments in that area via the agent security radar, because that is where the attack surface shifts fastest.

Higher bug bounties: the amounts

In the second post OpenAI raises the rewards in the Security Bug Bounty program. The goal is explicitly to get independent researchers to find vulnerabilities in OpenAI software 'that our testing may have missed'. According to the company, it is more than quadrupling the midpoint of its reward ranges for medium, high and critical findings on average; the sprint post states that OpenAI is 'more than quadrupling our rewards for critical findings'.

The new amounts: a critical vulnerability in a core product such as ChatGPT, Codex or the API Platform now earns up to $30,000. Exceptional critical findings on those targets remain eligible for up to $100,000 as a base amount, and now up to $172,000 with bonuses. That distinction matters: $100,000 is the base maximum, $172,000 is only reachable if bonuses are added on top. In its own example the company names an outcome of $171,925.

For researchers who do this work more often, it is sensible to know the ranges before you start on a target. The bands per severity level determine in practice where you put your time. If you work with automated tooling or your own models, also look at how you shield your own environment; managing API keys securely is one of the first things that goes wrong when you want to work quickly.

Bonuses for quality, loyalty and campaigns

OpenAI adds three kinds of bonuses. The first is a quality bonus: a multiplier on the base reward for a reliable proof of concept that isolates the bug, shows when it can be exploited and demonstrates the impact. The second is a loyalty program with five tiers, in which previous good participation translates into a higher multiplier. The third consists of priority campaign multipliers: short-term campaigns with their own bonus pools for newly launched features.

The quality bonus steers behavior that every security team wants to see. A report isolates the bug – not an entire application, but the specific point. A report shows when the bug can be exploited, meaning under which conditions and with which permissions. And a report demonstrates the impact. If you put those three elements in your report, the chance is greater that a triager can proceed without back-and-forth questions.

The loyalty bonus rewards returning researchers, which is logical from the perspective of a program owner: someone who knows the scope generally delivers more usable reports. The campaign multipliers direct attention to specific, recently released functionality – exactly the surface where new code and new mistakes come together.

In everything you investigate, the basic rule remains that you keep instructions and data separate; keeping instructions separate from data is the basis of prompt security and comes back in almost every report around models. Detecting misuse of the models themselves has also become a field of its own; how OpenAI and Anthropic handle that is described in this piece on misuse detection at both labs.

Worked examples from OpenAI

OpenAI gives four illustrative examples. The company stresses that all scenarios and historical amounts are illustrative. The table below takes them over one to one, including the multipliers.

What stands out in the worked examples is that the jump does not come from the base amount alone. In the critical example, $30,000 becomes $51,577 because three multipliers are applied on top. In the exceptional example the base amount stays at $100,000 and the increase comes entirely from the bonuses. So do not calculate with the highest number you come across, but with the range that fits your finding.

Retroactive application

OpenAI applies the new rules partly retroactively. Reports that have already been submitted but not yet awarded fall under the new reward ranges. For bounties awarded in the 30 days preceding the announcement, OpenAI pays the difference if the finding would have earned more under the new ranges. That concerns the base award plus the loyalty awards.

That is practically relevant if you reported recently and have already received the amount. In that case you do not need to submit a new report yourself: the difference is determined automatically on the basis of the new ranges, insofar as the finding would be worth more under them. If you submitted a report that is still awaiting assessment, the new range applies as soon as the assessment is completed.

For teams setting up their own disclosure process, this is a detail to remember: if you ever adjust your reward structure, determine in advance what you do with reports still in the pipeline. Nothing damages researchers' trust as much as an increase that just does not apply to their report.

PROMPT2PWN in Oakland

OpenAI does not leave it at a blog post. On 20 and 21 November the company's security team will be at PROMPT2PWN in Oakland, where researchers can test targets in person. The announcement contains the sentence that sets the tone for the whole program: 'We want OpenAI to be a team you come back to when you find something we've missed.'

A live event changes the dynamics of a bounty program. You can ask questions about scope directly, you get context on a target faster, and you can talk through with the team what makes a usable report. If you are considering taking part, it is useful to have your report structure in order beforehand, so that you can test on site and work it out at home.

Why AI labs are scaling up their own defenses

The underlying reasoning in both posts is that threats emerge faster than classic defense can keep up with. OpenAI formulates it as: traditional cyber defense alone is no longer sufficient, and organizations must keep the 'defender's window' open by using frontier cyber capabilities to harden their systems. That is a statement about tempo and about continuity, not about a specific incident.

For defenders that means a shift in the question you ask yourself. Not: did we do a penetration test this year? But: how quickly after a weak spot is introduced do we know about it, and how quickly is it fixed? A loop with a short turnaround time is more valuable than an in-depth test with a long turnaround time, provided the quality of the findings stays up to standard. That is exactly where the requirements for a proof of concept and the quality bonus come together.

The external view remains necessary in this. A team that tests its own systems with its own models runs the risk of being blind to the assumptions built into the design. A partner such as Cathedral brings different methods and angles. That explains why OpenAI in the same week both scales up internally and pays more externally: they are two ways of shrinking the same blind spots.

What this means for researchers and builders in the Netherlands and Europe

If you investigate vulnerabilities in the Netherlands or elsewhere in Europe, in practical terms mainly the valuation of your work changes. A well-substantiated report about a critical vulnerability in a core product now earns up to $30,000, and for exceptional findings with bonuses up to $172,000. The ranges also make it easier to estimate in advance whether a target is worth your time.

Do note the European context. Bounty work is not a license to test without agreements: you remain bound by the scope of the program and by the rules for responsible disclosure. Make sure you can demonstrate that you stayed within the agreed boundaries, and that you did not request or retain more data than necessary to demonstrate the finding. That is not only proper, it also protects your own position.

For builders who make applications with these models, the lesson is that the attack surface moves with your architecture. New features mean new mistakes, and that is precisely why OpenAI sets up short-term campaigns with their own bonus pools for recently launched functionality. If you release something yourself, it is sensible to ask the same question: who looks at this feature with fresh eyes, and how quickly after someone finds something is it fixed?

For IT teams that do not have a bug bounty program, it remains interesting to look at how OpenAI structured the sprint: freeing up part of the engineers for a period to investigate findings, reproduce them in an isolated environment and prepare patches for review. That is a model you can replicate without a large budget too, as long as you agree who assesses the findings and how a fix is verified.

Practical checklist

If you want to take part in a program like this, or want to bring the same discipline into your own team, it helps to have a number of things in order beforehand:

• Read the scope and the rules of the program before you start, and stay within the agreed boundaries.
• Write a proof of concept that isolates the bug: one concrete path, not a description of a category of problems.
• Describe when the vulnerability can be exploited, including which permissions or conditions are needed.
• Demonstrate the impact with a concrete scenario, without requesting or retaining more data than necessary.
• Follow the rules for responsible disclosure when reporting, even if you think it is going slowly.
• Document your steps and times, so that a triager can reproduce your work without extra questions.
• Test findings in an isolated environment before you submit anything.
• After a fix, verify whether the vulnerability has actually disappeared, not just whether the patch has been rolled out.
• Manage keys and tokens you use during testing carefully and clean them up when you are done.
• Keep instructions and data strictly separate in everything that has to do with models.

The two announcements show where the emphasis will lie in the coming period: continuously finding and fixing weak spots, internally with its own teams and models, externally through rewards and a partnership with Cathedral. For researchers, the new ranges and bonuses are the most tangible part. For builders and IT teams, the interesting question is how you get that same loop into your own environment, with a short turnaround time and a clear owner.

If you want to prepare for 20 and 21 November in Oakland, it is wise to separate the testing work from the writing work: test on site, work out the report at home. And if you are not going to Oakland, you can use the new ranges as a reason to run through your own disclosure process once more, including the question of what you do with reports still being processed.

Checked on 2026-11-04.

This article was compiled with AI assistance and editorially reviewed; sources are listed below.

Sources

• OpenAI, blog post about the next internal security sprint and the partnership with Cathedral: https://openai.com/index/preparing-our-next-security-sprint-to-harden-openai
• OpenAI, blog post about the increased rewards in the Security Bug Bounty program, including the worked examples: https://openai.com/index/rewarding-defenders-with-bigger-bug-bounties