> ## Content Index
> Fetch the complete content index at: https://globalfeed.ai/llms.txt
> Use this file to discover other available public pages before exploring further.

# OpenAI now pays up to $172,000 for the bugs it missed
- URL: https://globalfeed.ai/en/openai-now-pays-up-to-172-000-for-the-bugs-it-missed/
- Published: 2026-11-03T21:42:20.000Z
- Updated: 2026-11-03T21:42:20.000Z
- Description: OpenAI more than quadrupled its bug bounty rewards and brought Cathedral into its next security sprint. What the last round found and how the new rewards work.
- Author: GlobalFeed Editor
- Tags: OpenAI, cybersecurity, bug bounty, Codex, artificial intelligence, x-OpenAI, dil-en, elle

A researcher who finds a serious vulnerability in OpenAI’s products can now earn up to $30,000, and up to $172,000 with bonuses for an exceptional finding. On 2 November the company made two announcements together: it sharply raised the rewards in its bug bounty program, and it [said](https://openai.com/index/preparing-our-next-security-sprint-to-harden-openai/?ref=globalfeed.ai) its next internal security sprint will bring in an outside firm, Cathedral. The idea is simple: break into your own house before attackers do, and fix what you find right away. Here is what the sprint is, what the last round produced and how researchers can use the new reward system.

## What the security sprint is

The sprint is a concentrated period in which OpenAI uses its own models to test its own systems. The company says the next round brings new researchers and security partners together with its teams. The first partner is Cathedral, whose researchers will use OpenAI’s models alongside OpenAI’s teams to challenge its defenses. Cathedral CEO and co-founder Gavin Kliger says OpenAI is setting an important example by working with outside firms and using its own models to test its defenses continuously, and that every company should think about putting these capabilities to work.

The announcement gives no dates or duration. OpenAI frames the work as part of building continuous defensive loops that find and fix weaknesses before attackers do, and says traditional cyber defenses alone are no longer sufficient.

## What the last round showed

OpenAI says it dedicated 25% of its product engineers to finding and fixing weaknesses in the previous sprint. Using Codex, engineers investigated findings, reproduced vulnerabilities in isolated environments and prepared patches for review. The company shares the architecture and lessons on a page called [Defense Factory](https://openai.com/the-defense-factory/?ref=globalfeed.ai). According to that page:

- The sprint mobilised more than 250 people, and 53 urgent or high-priority issues were closed on the first day.
- With agents routing findings to the right team, accepted ownership reached 90.6%.
- Repeated runs showed that 37% of findings were duplicates.
- 19.5% of findings were reproduced at runtime, and after that dynamic validation the false-positive rate was 0.81%.
- All remediation was done with Codex, and the rollback rate for fixes was 0.53%.

Think of it as a building-wide fire drill: everyone is on the floor the same day, every blocked exit gets an owner, and each fix is checked independently. Defense Factory describes the process as a five-step loop: inventory, discovery, dynamic validation, ownership handoff and verified fix. OpenAI says the key lesson was building isolated, freshly created development environments where agents can safely reproduce vulnerabilities and test fixes.

## New rewards for researchers

According to the [bounty announcement](https://openai.com/index/rewarding-defenders-with-bigger-bug-bounties/?ref=globalfeed.ai), OpenAI more than quadrupled the midpoint of its reward ranges for medium, high and critical findings on average. A critical vulnerability in a core product such as ChatGPT, Codex or the API Platform now earns up to $30,000\. Exceptional critical findings stay eligible for up to $100,000, and up to $172,000 with the new bonuses. The new pieces:

- **Quality multiplier:** reports with a reliable proof of concept that isolates the bug and shows when and how it can be exploited earn a bonus multiplier.
- **Loyalty program:** a five-tier bonus system for researchers who report consistently.
- **Priority campaigns:** short-term bonus pools for newly launched features.
- **Retroactive payments:** unawarded reports get the new ranges, and bounties paid in the 30 days before the announcement get the difference.

One example in the announcement shows the change: a one-click ChatGPT account takeover that previously had an illustrative award of $6,500 now reaches $51,577 with bonuses. OpenAI’s security team will meet researchers at PROMPT2PWN in Oakland on 20-21 November.

OpenAI also notes that it makes its most capable models available to defenders through Daybreak and has committed $1 billion in subsidised access over six months for those protecting essential services and digital infrastructure. If you are a security researcher, the current reward table and rules are on the official program page linked from the announcement.

Cover photo: 1515 Third Street, San Francisco, [Coolcaesar, Wikimedia Commons](https://commons.wikimedia.org/wiki/File:1515%5FThird%5FStreet.jpg?ref=globalfeed.ai), CC BY 4.0.

Sources: [OpenAI security sprint announcement](https://openai.com/index/preparing-our-next-security-sprint-to-harden-openai/?ref=globalfeed.ai), [OpenAI bug bounty announcement](https://openai.com/index/rewarding-defenders-with-bigger-bug-bounties/?ref=globalfeed.ai), [OpenAI Defense Factory](https://openai.com/the-defense-factory/?ref=globalfeed.ai)