OpenAI Taps Cathedral Systems, Raises Bug Bounty to $172,000

Highlights

OpenAI announced a security sprint with Cathedral Systems on November 2, 2026.
Cathedral researchers will use OpenAI's models to test OpenAI's own defenses.
Critical flaws in ChatGPT, Codex and the API Platform now pay up to $30,000.
Exceptional critical findings: $100,000 base award, about $172,000 with bonuses.
OpenAI is also committing $1 billion in subsidized access for frontline cyber defenders.

OpenAI is changing how it secures its systems. The ChatGPT maker is bringing in outside researchers to attack its own defenses using OpenAI models, while sharply raising rewards for bug hunters.

OpenAI made the announcement on Monday, November 2, 2026. Its argument: as AI gets better at finding vulnerabilities, defenders need to put it to work before attackers do.

Quick answer: On November 2, 2026, OpenAI announced its next internal security sprint with Cathedral Systems, whose researchers will use OpenAI models to probe the company's defenses. OpenAI also raised its bug bounty: critical vulnerabilities in ChatGPT, Codex and the API Platform now pay up to $30,000, and exceptional critical findings qualify for a $100,000 base award, with bonuses bringing totals to about $172,000.

The Security Sprint with Cathedral Systems

In the sprint, Cathedral Systems researchers will work alongside OpenAI teams, using OpenAI's models to find weaknesses, test fixes and strengthen defensive methods. Interesting Engineering reports OpenAI believes traditional cyber defenses alone are no longer sufficient, and wants continuous defensive loops that find and fix weaknesses before attackers do.

The previous sprint involved about 25% of OpenAI's product engineers, who used Codex to investigate and reproduce vulnerabilities in isolated environments and prepare patches. OpenAI has not said when the next sprint will begin.

Cathedral CEO and co-founder Gavin Kliger said: "OpenAI is setting an important example by partnering with outside security firms and using its own models to continuously test and strengthen its defenses. Every company should be thinking about how to put these capabilities to work."

How the Bug Bounty Rewards Changed

Category	Reward
Critical flaws in ChatGPT, Codex, API Platform	Up to $30,000
Exceptional critical findings (base award)	$100,000
Maximum total including bonuses	About $172,000
Factors in final payout	Report quality, researcher track record, priority campaigns

OpenAI says rewards for critical findings have more than quadrupled. The top payout applies only to findings judged exceptional, not to every critical bug.

$1 Billion in Access for Cyber Defenders

Alongside the announcement, OpenAI is making its most capable models available to Daybreak customers. It has committed $1 billion in subsidized access over six months for frontline defenders protecting essential services and digital infrastructure, and is sharing its architecture and lessons from the previous sprint.

FAQ (Frequently Asked Questions)

1. What did OpenAI announce?

An internal security sprint with Cathedral Systems and higher bug bounty rewards, announced November 2, 2026.

2. What is OpenAI's top bug bounty now?

Up to $30,000 for critical flaws in ChatGPT, Codex and the API Platform. Exceptional critical findings get a $100,000 base award, up to about $172,000 with bonuses.

3. Who is Cathedral Systems?

A cybersecurity firm led by CEO and co-founder Gavin Kliger. Its researchers will use OpenAI's models to test OpenAI's defenses.

4. When does the sprint start?

OpenAI has not announced a start date.

5. What is Daybreak?

OpenAI's program for cyber defenders; OpenAI committed $1 billion in subsidized model access over six months.

Conclusion

OpenAI's move reflects a shift: AI is no longer just something to protect but also a tool for defense. By partnering with Cathedral Systems and raising its bug bounty, OpenAI hopes defenders find the holes before attackers do.