OpenAI raises bug bounties to up to $172,000 with bonuses and brings in Cathedral for its next AI-driven security sprint
OpenAI said on 2 November that it is more than quadrupling reward ranges for critical vulnerabilities, with critical bugs in core products paying up to $30,000 and exceptional findings up to about $172,000 including bonuses. It also said researchers from security firm Cathedral will join its next internal security sprint, using OpenAI models alongside OpenAI teams to test its defenses.
According to RuntimeWire and AlphaSignal, the cap for critical core-product bugs rises to $30,000; exceptional findings, previously capped at $100,000, can now reach about $172,000 with the new bonuses. Submitted reports not yet awarded will be paid under the new ranges, and for bounties awarded in the 30 days before the announcement OpenAI will pay the difference where the new ranges would have paid more.
AlphaSignal says the top rewards are reserved for findings that demonstrate concrete agentic abuse or platform-integrity risk, agentic findings must reproduce in at least 50% of attempts, and simple jailbreaks without demonstrated safety impact remain out of scope.
In the sprint, Cathedral researchers will use OpenAI models alongside OpenAI teams to challenge its defenses, and Blockchain.News says OpenAI will keep expanding model access for trusted defenders. AlphaSignal notes that the announcement does not specify Cathedral’s access level, targets or timeline; Cathedral was founded in 2026 by former DOGE staffers, raised $160 million at a $1.4 billion valuation from a16z and Sequoia, and previously reached Anthropic’s internal systems through third-party software during a bug bounty investigation, with the two sides disputing whether bounty rules were broken.
Both openai.com posts returned 403 to our direct fetch, so these details rely on the outlets above.
Sources
- OpenAI Raises Bug Bounty to $172,000 to Hunt Its Own Flaws — AlphaSignal
- Cathedral will use OpenAI models to test OpenAI’s defenses — RuntimeWire
- OpenAI, Cathedral Systems launch security sprint, boost bounties — Blockchain.News