> status: mostly fine. patch anyway.practical AI security · est. 2026

Brief · Both

OpenAI's security sprint pays more for the big bugs, but patching is all they've got

By alkizz ·

On Nov 2, OpenAI published two posts on the same evening. The first says it's planning its next internal security sprint and partnering with Cathedral, "whose researchers will use OpenAI’s models alongside our teams to challenge our defenses." The second raises its Security Bug Bounty, and the headline number is real: "A critical vulnerability in a core product such as ChatGPT, Codex, or the API Platform will now earn up to $30,000," and exceptional findings can now reach "up to $172,000 with bonuses." Bigger bounties are good news for researchers, and I'm not going to pretend otherwise. But I read both posts twice, and I keep coming back to the same thought: they're also super interested in security now that they've created the tools that make finding vulns faster than ever, restrict researchers' access to those tools, and want to limit open models.

What actually changed

The money first, because it's the part people will share. On Bugcrowd, critical (P1) findings on the core ChatGPT and API targets went from $2,000–$6,500 to $10,000–$30,000, and the Codex group (now "ChatGPT Desktop & Codex CLI") jumped from $500–$1,500 all the way to the same $10,000–$30,000. The exceptional cap stays at a $100,000 base, and the $172K figure is what you get when you stack the new quality, loyalty and priority-campaign multipliers on top of it (OpenAI's own example works out to $171,925). There's also a retroactive top-up for bounties awarded in the 30 days before the announcement, which is a genuinely decent touch.

The less shareable part is in the Bugcrowd brief rather than the blog post. Low-severity findings no longer pay, and the brief now reads: "You may still report Low (P4) and Informational (P5) findings, but those priorities do not carry a base bounty." Before this change, P4s on the core groups paid $200–$500. That isn't a fortune, but in my experience the low-severity stuff is where a lot of the boring hygiene problems get reported, and boring hygiene problems are how a lot of real break-ins start. If you stop paying for them, I'd expect fewer people to bother writing them up.

The vendor rules got stricter too. The Third Party Corporate Targets section now says "Do not test the provider's systems" and "Stop as soon as the exposure is visible," and it tells researchers not to open more documents or search for more records to show how big an exposure is.

The Cathedral part

Cathedral is the startup founded by former DOGE staffers that I wrote about in my Oct 26 Calm down, after Cathedral said its testing under Anthropic's bug bounty got into Anthropic through third-party vendor apps. Later coverage reports that Anthropic's Logan Graham said targeting third-party providers and pulling data went beyond the program's safe harbor (The Decoder), though that account comes from secondary write-ups and I haven't seen it on a primary source. So OpenAI's new vendor rules ban what Anthropic reportedly said Cathedral did, and OpenAI picked Cathedral as its sprint partner on the same day. OpenAI hasn't said whether those two things are connected, and I'm not going to claim they are, but it's a funny pair of posts to publish together.

What the sprint post doesn't say is also worth noticing. It gives no sprint dates, no scope or terms for Cathedral, no numbers on what the last sprint found or fixed, and nothing about data use or training.

Security = patching, again

Here's how OpenAI describes its last sprint: it put a quarter of its product engineers on finding and fixing weaknesses, and "Using Codex, engineers investigated findings, reproduced vulnerabilities in isolated environments and prepared patches for review." So the loop is find, reproduce and patch, and then do it again with a better model. To me, it also backs up why they desperately want security to equal patching, and I think that's why the framing is so convenient. If security means finding and patching bugs faster, then the company selling the fastest bug-finding models is selling the answer.

Patching matters, and I'm not knocking it. But as I argued in Patching vs. Security, plenty of real incidents come in through the help desk, vendor OAuth tokens and keys nobody revoked, and no patch fixes those. The Cathedral episode at Anthropic is a decent example, since by the public accounts it came in through vendor apps and not through a bug in the model.

Who gets the good tools

The access side bothers me more than the bounty math. Trusted Access is gated, and OpenAI's data controls page says that during Daybreak sessions on a personal account, content from those interactions may be used to improve its models even when "Improve the model for everyone" is off, which I covered in more detail in the Daybreak brief. The bigger worry for me is that frontier labs can restrict or refuse their models in the middle of an incident, right when defenders need them most, so keep a vetted fallback model ready, like a self-hosted one. Hugging Face's forensics team ended up moving to a self-hosted open-weight model after hosted models refused much of the work, which I wrote about in Your AI might refuse to help mid-breach. None of the Nov 2 posts or the new Bugcrowd brief says anything about training on researcher data or Daybreak sessions, so nothing has changed there. The sprint post's promise of "expanding access for trusted defenders" comes with no details and no date.

So the picture I see is this: the best bug-finding tools sit behind an approval process the vendor controls, the personal-account sessions inside that process may be used to train the vendor's models, and the vendor pays well for the big bugs and no base bounty for the small ones. My opinion, and it's mine, not anything OpenAI or the other big labs have said, is that the big labs would like to restrict open models without saying so outright, because open models are the one version of these tools they can't gate. You don't have to agree with that to notice that "use our models, through our program, on our terms" is a business plan as much as a security plan.

None of this is a reason to panic, though. In my experience attackers still mostly get in the boring ways, and the boring defenses still work.

What to do:

Sources

Related

On the checklist

More briefs

← All briefs