OpenAI plans another internal security sprint and raises bug-bounty rewards

OpenAI published a post on 2 November 2026 saying it is planning its next internal security sprint, and that it is partnering with Cathedral, whose researchers will use OpenAI's models with OpenAI's teams to test defences. The post says the last sprint dedicated 25% of product engineers to finding and fixing weaknesses, using Codex to investigate findings, reproduce vulnerabilities in isolated environments and prepare patches for review. It says OpenAI is more than quadrupling its rewards for critical findings in the Security Bug Bounty programme. It also says OpenAI has committed $1 billion in subsidized access over six months for frontline defenders protecting essential services and digital infrastructure, through what the post calls Daybreak customers.

A second OpenAI post the same day says the company is more than quadrupling the midpoint of its reward ranges for medium, high and critical findings on average. It says a critical vulnerability in a core product such as ChatGPT, Codex or the API Platform will now earn up to $30,000. It says exceptional critical findings on those targets remain eligible for up to $100,000, and now up to $172,000 with bonuses. It says reports not yet awarded will use the new ranges, and that for bounties awarded in the 30 days before the announcement OpenAI will pay the difference if the finding would have earned more under the new ranges. A table of example payouts is labelled illustrative. The post says the security team will be at an event in Oakland on 20 and 21 November.

What it means for business: the $1 billion figure is subsidised access for defenders, as the sprint post states it, not a cash grant described as paid on 2 November. The bounty caps are the amounts the second post says a finding can earn. The illustrative table is not a schedule of awards that will be paid. This describes the two posts. It is not advice on a disclosure programme.