Skip to content
Neural Daily

BusinessNews

OpenAI quadruples bug bounties, plans AI security sprint

🇭🇺 Olvasd el magyarul →

OpenAI is more than quadrupling its average bug bounty rewards, with up to $172,000 for exceptional findings. Its next internal security sprint, with Cathedral Systems, uses its own models.

By: Mikola Máté Patrik · · 3 min read

OpenAI title card reading Rewarding defenders with bigger bug bounties on an orange to purple gradient
Image: OpenAI · Press kit · Official social image of the OpenAI announcement · Source

What happened?

On November 2, OpenAI raised the rewards in its Security Bug Bounty program (OpenAI). For medium, high and critical findings, the midpoint of the reward ranges more than quadruples on average. The same day it announced its next internal security sprint, run together with security firm Cathedral Systems (OpenAI).

How much can researchers earn now?

A critical vulnerability in a core product, meaning ChatGPT, Codex or the API Platform, now earns up to $30,000. Exceptional critical findings remain eligible for up to $100,000, and up to $172,000 with bonuses. Three new multipliers apply on top of the base award:

  • Quality bonus: reports with a reliable proof of concept that isolates the bug and demonstrates its impact get a multiplier on the base bounty.
  • Loyalty program: a five-tier system with scaling bonuses for researchers who keep coming back.
  • Priority campaigns: short-term campaigns with dedicated bonus pools for newly launched features.

In OpenAI's illustrative example, a one-click ChatGPT account takeover that used to pay $6,500 would now pay $51,577. Reports not yet awarded get the new ranges, and bounties paid in the 30 days before the announcement will be topped up to the difference.

What is the security sprint?

In its last sprint, OpenAI dedicated 25% of its product engineers to finding and fixing weaknesses in its own systems. Engineers used Codex to investigate findings, reproduce vulnerabilities in isolated environments and prepare patches for review. In the next round, Cathedral Systems researchers will also use OpenAI's models to challenge the company's defenses.

OpenAI argues that traditional cyber defenses alone are no longer sufficient and that continuous, AI-driven defensive loops are needed. Alongside this, it has committed $1 billion in subsidized access over six months for defenders protecting essential services, and is sharing the architecture and lessons from its last sprint.

Why it matters

ChatGPT and Codex handle more and more company data and code, so every bug found is worth a lot. Bigger rewards should draw more outside researchers, and the sprint shows OpenAI putting its own models to work on defense in production. Security researchers have a good reason to take another look at OpenAI's targets, and the company will be at PROMPT2PWN in Oakland on November 20 and 21.

    Produced with the help of AI, reviewed by an editor. How we make our articles

    Reviewed and edited by the Neural Daily desk. About

    Related articles