Understand this story
On November 3, 2026, OpenAI announced plans to conduct the next round of internal security sprints and to partner with Cathedral Systems, whose researchers will use OpenAI models to challenge its defense systems together with the OpenAI team. The bug bounty adjustments announced the same day show that critical vulnerability bounties have been increased more than threefold, reaching up to $172,000 including bonuses; the new standards also apply to reports pending review, and bounties already paid over the past 30 days will be topped up to the difference if they qualify under the new tiers. Other reports say this bounty update raises the median reward ranges for medium-, high-, and critical-severity vulnerabilities by an average of more than fourfold, with critical vulnerabilities in core products such as ChatGPT, Codex, or the API Platform eligible for up to $30,000. No further developments have been disclosed at this time.
AI-generated from public reports
Latest development · Report
Reuters: OpenAI Employees Warned About Internal Security Risks for YearsDevelopments
1 confirmed developments
Reports and discussion timeline
Browse reports and discussion by time. Their evidence levels remain distinct.
Nov 4
Unite.AI
Reuters: OpenAI Employees Warned About Internal Security Risks for Years
Reuters reported that some OpenAI employees had warned company leadership and the board for years about issues such as overly broad code access, the lack of regular security reviews for internal tools, and insider threats. OpenAI said its most sensitive work has been placed in isolated repositories with strictly limited access, that it has conducted regular security reviews of internal tools since Chief Information Security Officer Dane Stuckey joined in October 2024, and that it will hold another internal security sprint with Cathedral and more than triple its critical bug bounties.
Nov 3
Yicai
AI Evolution Express: Baidu Apollo World Model Debuts, SenseTime Launches SenseNova 6.8 Flash Official Version
Baidu Apollo World Model debuts, SenseTime launches SenseNova 6.8 Flash official version. Fujian's first cross-domain heterogeneous scheduling full-service token factory goes online, Seedance's overseas revenue grows nearly 5x in half a year, Tencent ranks among the top three domestic customers. Xingyun Technology signs a framework cooperation agreement with Volcano Engine, focusing on large models, GPU services and other directions; OpenAI reaches a cybersecurity cooperation with Cathedral Systems.
The Decoder
OpenAI raises bug bounties to a maximum of about $172,000
OpenAI announced it is quadrupling its bug bounties: critical vulnerabilities in core products such as ChatGPT and Codex can earn up to $30,000, exceptional findings can reach $100,000, and with quality, loyalty, and event bonuses stacked on top, the total comes to about $172,000. It added a five-tier loyalty program and time-limited bonus campaigns tied to new product launches, and those who submitted vulnerability reports in the past 30 days will receive the difference between the old and new rates. OpenAI is also preparing a security sprint in which the security firm Cathedral and its own engineers will stress-test its systems together; the company says 25% of its product engineers took part in vulnerability hunting during the last sprint.
Unite.AI
OpenAI Plans New Security Sprint and Raises Bug Bounty
OpenAI announced plans to conduct a new round of internal security sprints with external researchers such as Cathedral. On the same day, the bug bounty update raised the median reward ranges for medium-, high-, and critical-severity vulnerabilities by an average of more than fourfold. Critical vulnerabilities in core products such as ChatGPT, Codex, or the API Platform can earn up to $30,000, and particularly severe findings can reach $172,000 after bonuses. In previous sprints, OpenAI committed 25% of its product engineers, used Codex to reproduce vulnerabilities and prepare patches, mobilized more than 250 people covering over 100 service areas, and closed 53 urgent or high-priority issues on the first day. OpenAI will also open its strongest models to Daybreak customers for authorized defensive work, a program corresponding to a $1 billion commitment and a six-month usage target.
OpenAIFirst-party
OpenAI Partners with Cathedral Systems for Security Sprint, Critical Vulnerability Bounties More Than Tripled
OpenAI plans to run its next internal security sprint and is partnering with Cathedral Systems, whose researchers will use OpenAI models to challenge its defenses alongside the team. Bounties for critical vulnerabilities have been increased more than threefold, reaching up to $172,000 including bonuses; the new standards also apply to reports pending review, and bounties paid out over the past 30 days will receive the difference if they qualify under the new tiers.
Heat trend for this story
- Current
- 5
- Period peak
- 18 Nov 3 17:00
- 24-hour change
- -50%
Move the pointer or select the chart to inspect hourly heat. Use the left and right arrow keys with a keyboard.