OpenAI is overhauling its Security Bug Bounty program and partnering with Cathedral to probe its own systems, pairing higher payouts for outside researchers with a new internal security sprint.
Bounty structure
The midpoints of reward ranges for medium, high, and critical findings have more than quadrupled on average2,3. A critical vulnerability in a core product such as ChatGPT, Codex, or the API Platform now carries a base bounty of up to $30,000. Exceptional critical findings remain eligible for base bounties of up to $100,000, with total payouts reaching up to $172,000 when bonuses are included.
High-quality reports are eligible for a multiplier on the base bounty; OpenAI said a reliable proof of concept helps engineers develop a fix by isolating the bug, showing when it can be exploited, and demonstrating its impact. The company also introduced a five-tier loyalty program offering larger bonuses at higher tiers, and short-term campaigns will have dedicated bonus pools for researchers who test newly launched features. Reports already submitted but not yet awarded a bounty will receive the new reward ranges.
OpenAI described the bounty changes as complementing its Defense Factory work, in which engineers use the company's own models to find weaknesses, reproduce them, and test fixes.
Cathedral partnership and security sprint
Alongside the bounty revamp, OpenAI announced a partnership with Cathedral5,6. Cathedral researchers will use OpenAI models alongside company staff to challenge existing protections and bring fresh approaches to testing OpenAI's systems. Gavin Kliger, CEO and co-founder of Cathedral, said the collaboration would combine his team's research with OpenAI's models and security expertise to find weaknesses, test fixes, and improve continuous defense. No start date, target list, or vulnerability findings from the upcoming sprint have been disclosed.
The sprint builds on an earlier effort in which OpenAI assigned 25 percent of its product engineers to security work. During that sprint, engineers used Codex to investigate reports, reproduce vulnerabilities in isolated environments, and prepare patches for review.
ANALYSIS The bounty increase and the Cathedral engagement represent two sides of the same push: paying more to attract external vulnerability research while simultaneously embedding outside testers inside OpenAI's own workflow. The loyalty tiers and campaign-specific bonus pools add a retention layer that base-bounty increases alone would not provide.