OpenAI announced on November 2, 2026 a planned internal security sprint with Cathedral and other outside researchers, paired with higher bug-bounty rewards. Exceptional critical findings can now reach $172,000 after bonuses, while a standard critical flaw in ChatGPT, Codex or the API Platform pays up to $30,000. The move matters for business because it signals how leading AI vendors now combine outside testing with agent-driven remediation.
Planned sprint and new bounty terms
Cathedral researchers will work alongside OpenAI internal teams, using OpenAI models to challenge defenses and search for weaknesses. The announcement describes a planned sprint rather than completed testing. Cathedral CEO Gavin Kliger said the work pairs OpenAI models and security expertise with Cathedral research to find weaknesses, test fixes and support continuous defense. Other outside researchers are expected to take part in the same effort.
Reward ranges for medium, high and critical findings more than quadrupled at the midpoint on average, according to the separate bug-bounty announcement. Exceptional critical findings on core products remain eligible for up to $100,000 before bonuses. A quality multiplier applies to reports with a reliable proof of concept that isolates the bug, shows exploitability and demonstrates impact. A five-tier loyalty program adds scaling bonuses for repeat researchers, while priority campaigns create dedicated pools for testing newly launched features.
The new ranges apply to reports still awaiting an award. Researchers paid during the 30 days before the announcement will receive the difference where the new base and loyalty amounts would have paid more. Daybreak customers also receive access to OpenAI most capable models for authorized defensive work. That program, announced September 3, 2026, set a six-month consumption target under a $1 billion commitment covering subsidized access, training, support and partnerships, starting with resource-constrained U. S. operators of water and electricity services.
What this means for companies using AI
For companies that build on ChatGPT, Codex or the API Platform, the sprint plus higher payouts should increase the chance that flaws are found by researchers rather than attackers. Priority campaigns around new features are especially relevant for early adopters, since fresh releases often carry integration and access-control risks. Small firms gain indirectly through faster vendor fixes, while large organizations with direct API dependencies can factor the vendor validation cycle into their own release planning and change control.
The limits sit in deployment and verification, not in bounty size. OpenAI own follow-up checks found a gap between merged patches and fixes deployed across the fleet, so ticket movement does not prove remediation. The earlier sprint closed 53 urgent or high-priority issues on its first day, flagged 37% of findings as duplicates, reproduced 19.5% at runtime and recorded a 0.81% false-positive rate after dynamic validation. Buyers should therefore ask vendors what counts as fixed, what evidence confirms deployment, and how human review covers consequential changes.
The marker to watch is whether the planned sprint reports deployed and independently verified remediation instead of tickets marked complete. OpenAI earlier dedicated 25% of product engineers to the effort, mobilized more than 250 people across more than 100 service areas, and kept Codex-based remediation to a 0.53% rolled-back fix rate. If the next round repeats that operating discipline at higher reporting volume, enterprise customers will have a stronger basis to trust continuous agent-led defense.
