OpenAI raised its Security Bug Bounty rewards on November 2, 2026. A critical bug in ChatGPT, Codex or the API Platform now pays up to $30,000, and the best findings can reach $172,000 with bonuses. OpenAI says it is "more than quadrupling" the midpoint of its reward ranges for medium, high and critical findings on average. The same day, it said Cathedral, a security startup, will work with its engineers in the company's next internal security sprint. Both announcements are on OpenAI's own site: Rewarding defenders with bigger bug bounties and Preparing our next security sprint to harden OpenAI.
This is the next step in OpenAI's push to use its own models for defense, which we have followed through Daybreak and Codex Security and the Patch the Planet initiative. It also lands in a month where AI-found bugs, AI-generated junk reports and AI-driven penetration tests are all colliding with bounty programs.
Quick reference: what changed
| Question | Answer (source: OpenAI, November 2, 2026) |
|---|---|
| What is the new top regular reward? | Up to $30,000 for a critical bug in a core product (ChatGPT, Codex, API Platform) |
| What is the top exceptional reward? | Up to $100,000, and up to $172,000 with bonuses |
| What else is new? | Quality multipliers, a five-tier loyalty bonus, priority campaign bonus pools |
| Do old reports benefit? | Yes: pending reports use the new ranges; awards from the last 30 days get a top-up |
| Who is the sprint partner? | Cathedral, with its researchers using OpenAI models alongside OpenAI teams |
| Where is the in-person event? | PROMPT2PWN, Oakland, November 20 to 21 |
| Defender funding mentioned | $1 billion in subsidized access over six months for Daybreak customers |
Agents that act on your behalf need rules. See how explainx helps secure your agents →
How much do the new OpenAI bug bounty payouts add up to?
OpenAI publishes four worked examples. It labels all of them as illustrative, and each applies multipliers to a new base figure. We re-ran the arithmetic from the announcement.
| Example | Old award | New calculation | Result |
|---|---|---|---|
| Medium, ChatGPT core asset: a read-only member can upload files to a Project without write permission | $750 | $2,000 x 1.15 quality x 1.05 Bronze loyalty | $2,415 |
| High, Prism (non-core asset): IDOR that reads a file uploaded to a user's Project | $1,000 | $2,500 x 1.15 quality x 1.10 Gold loyalty | $3,162.50 |
| Critical, ChatGPT core asset: one-click account takeover | $6,500 | $30,000 x 1.15 quality x 1.30 priority campaign x 1.15 "31337" loyalty | $51,577 |
| Exceptional, ChatGPT core asset: a boundary compromise such as viewing arbitrary users' chat messages | $100,000 | $100,000 x 1.15 x 1.30 x 1.15 | $171,925 |
Two things stand out. First, the base moves a lot: the medium example goes from $750 to a $2,000 base, and the critical account-takeover example goes from $6,500 to a $30,000 base. Second, multipliers stack. The $172,000 headline is not a base reward. It needs a quality bonus, an active priority campaign and the top loyalty tier all at once, so treat it as a ceiling rather than an expectation. Our own calculation of the critical example gives $51,577.50, which OpenAI rounds down to $51,577.
A gear with a green bandage over a crack, showing how an OpenAI bug bounty report becomes a patch
What the three new bonus types reward
- High-quality report multiplier. OpenAI says a reliable proof of concept that isolates the bug, shows when it can be exploited and demonstrates impact "gives us a head start on a fix." The quality multiplier pays for that extra work.
- Loyalty tiers. A five-tier system scales bonuses for researchers who consistently report. The examples name Bronze, Gold and a top tier called "31337." OpenAI does not list the thresholds in the announcement; the full details sit in the bounty program page it links.
- Priority campaigns. Short-term bonus pools for newly launched features. They give researchers an early, high-reward window to test new products.
What researchers should do this week
- Read the program page linked from the announcement before testing. Scope and safe-harbor rules matter more than the payout table.
- Write reports with a working proof of concept and a clear impact statement. That is exactly what the quality multiplier targets.
- If you have a pending report, do nothing: the new ranges apply to it. If OpenAI paid you in the last 30 days, check whether the new base would have paid more.
- Watch for priority campaigns on newly launched features. Those are the multipliers most likely to move a payout.
- Test only OpenAI-owned targets within scope. Third-party software is a different matter, as the Cathedral dispute shows below.
What is the Cathedral security sprint?
OpenAI describes the sprint as "bringing new researchers and security partners together with our own teams to use our models to test and strengthen our systems." Cathedral's researchers "will use OpenAI's models alongside our teams to challenge our defenses." OpenAI quotes Cathedral CEO and co-founder Gavin Kliger saying every company should be thinking about how to put these capabilities to work.
OpenAI also describes the previous sprint with numbers: it "dedicated 25% of our product engineers to finding and fixing weaknesses in our systems." Engineers used Codex to investigate findings, reproduce vulnerabilities in isolated environments and prepare patches for review. The company says it is sharing the architecture and lessons from that sprint alongside its blueprint for empowering cyber defenders across industry and government. We have not read those documents as part of this post, so we do not summarize them here.
A shield with a hairline crack under a green patch, standing for the weaknesses an OpenAI security sprint hunts
Why the choice of Cathedral stands out
Cathedral was in the news a week before this announcement. On October 26, The Washington Post reported that Cathedral told Anthropic its AI agents penetrated internal systems in under 12 hours. Anthropic confirmed a narrower breach of sales, HR and IT systems and disputed the characterization and the timeline. Our claimed versus verified breakdown covers the dispute, including Anthropic's claim that the researchers broke bounty program rules by targeting third-party providers.
OpenAI's post does not mention that episode, and we found nothing in OpenAI's announcement that comments on it. What we can say from the two announcements is narrower: OpenAI is choosing to put the same firm inside its own sprint, under an agreed engagement, using OpenAI models. That is a different setup from an outside researcher testing a lab's vendors under a public bounty program. The contrast is useful for readers deciding how to structure their own red team work: a contracted sprint has defined scope, while a public bounty relies on researchers reading the rules correctly.
Where this fits in OpenAI's defender strategy
OpenAI frames both posts as part of "keeping the defender's window open." The company says it is using its most capable models to harden its own systems and making them available to Daybreak customers, with "$1 billion in subsidized access over six months for frontline defenders protecting essential services and digital infrastructure."
That framing connects to earlier OpenAI security work we covered:
- OpenAI's August argument that models should be superhumanly good at secure code, where the "defender's window" idea first appeared.
- GPT-5.6 Cyber and the Daybreak red and blue tracks.
- Cloudflare's Daybreak results, a customer-side view of vulnerability discovery and remediation with Codex.
- Trail of Bits' regression hunt under Patch the Planet.
The bounty change is the human-researcher half of the same approach. OpenAI's own wording is that bounties complement its "Defense Factory" work, "where our engineers use our models to find weaknesses, reproduce them, and test fixes." Models find a lot, but OpenAI is saying outside researchers still catch what its testing misses, and it will now pay more for that.
How does this compare with other AI bug bounties?
We do not have a verified, like-for-like table of other labs' payout ranges, so we do not publish one. Two related stories show the pressure on bounty programs from AI:
- Google froze its open source bounty because of AI-generated junk reports. See Google freezes its Open Source VRP.
- Separately, XBOW won $250,000 for a Chrome full-chain exploit built with GPT-5.6 Sol, showing AI-assisted work can earn top-tier payouts when it is real.
OpenAI's quality multiplier is a direct response to that tension. A program that pays more for reports with reliable proofs of concept rewards the opposite of slop. OpenAI does not say in its announcement how it will filter AI-generated submissions, so that part is an open question.
What this means for builders and security teams
- If you ship on OpenAI APIs, nothing in your integration changes. The change affects who gets paid for finding bugs in OpenAI's own products, not your API behavior.
- If you run your own bounty program, the structure is worth copying: pay for proof-of-concept quality, reward repeat reporters, and run time-boxed campaigns for new features.
- If you use AI agents for security testing, read the scope rules for third-party software first. The Cathedral dispute turns partly on whether testing third-party providers falls inside a program's safe harbor.
- If you operate agents internally, treat the sprint approach as a template: isolated reproduction environments, patches prepared for human review, and a share of engineers dedicated to the work. To detect or stop dangerous agent actions in your own environment, see AgentBeam, the agent security platform from the explainx.ai team.
What is still unknown
- OpenAI has not published the loyalty tier thresholds in the announcement text we read.
- It does not state the sprint's dates or scope, or how Cathedral's engagement is priced.
- The "more than quadrupling" figure is an average of midpoints across medium, high and critical bands. OpenAI does not give per-band old and new ranges in the post, only the examples above.
- OpenAI's illustrative examples are not historical payouts.
Figures and program details are accurate as of November 3, 2026, based on OpenAI's November 2 posts. Check the official Security Bug Bounty page for current terms before you submit a report.
Related reading
- OpenAI Daybreak and Codex Security: cyber defense explained
- Patch the Planet and AI-found bugs
- Cathedral and Anthropic: claimed vs verified
- Cloudflare and OpenAI Daybreak results
- Google freezes its open source bug bounty
- XBOW's $250,000 Chrome exploit
- OpenAI: superhumanly secure code and the defender's window