OpenAI Raises Bug Bounty to $172,000 to Hunt Its Own Flaws

OpenAI has launched an internal security sprint that combines AI-assisted offensive testing, a partnership with cybersecurity startup Cathedral Systems, and higher bug bounty payments. Exceptional vulnerability reports can now earn up to $172,000 after bonuses.

The security case is straightforward: language models can accelerate code review, vulnerability discovery, and exploit development. OpenAI wants authorized researchers and its own security teams using those capabilities against its systems before attackers do. For developers, the immediate changes concern vulnerability reporting and platform security; OpenAI announced no related API, model, or SDK changes.

Cathedral’s contested track record

OpenAI named Cathedral as a partner in the sprint, which uses authorized attacks to find weaknesses in the company’s infrastructure. The announcement does not specify Cathedral’s access level, testing targets, or timeline.

Cathedral was founded in 2026 by former Department of Government Efficiency staffers Gavin Kliger, Luke Farritor, Marko Elez, and Jack Stein. The company raised $160 million at a $1.4 billion valuation from Andreessen Horowitz and Sequoia Capital to develop AI tools for U.S. military cyber operations.

Cathedral previously used AI agents during an Anthropic bug bounty investigation to gain access to internal systems through third-party software. Anthropic confirmed that the researchers reached sales, human resources, and IT data, although it disputed the extent of the access. The Washington Post reported that exposed material included Slack messages, meeting transcripts, salaries, and job offers.

The reported entry point involved weaknesses in third-party software controls rather than a novel attack on an AI model. Anthropic later accused Cathedral of withholding information and violating its bug bounty rules. Cathedral maintains that it followed standard security research practices. That dispute makes testing boundaries, disclosure requirements, and evidence retention central to the OpenAI engagement.

How the $172,000 ceiling adds up

OpenAI’s bounty update raises rewards for critical vulnerabilities and applies the new ranges to some existing submissions.

OpenAI’s fourfold figure applies to its critical reward ranges. The bonus-inclusive ceiling for exceptional findings rose from $100,000 to $172,000.

The new ranges also apply to reports already awaiting review. OpenAI says it will pay the difference on eligible bounties awarded during the previous 30 days, giving recent and pending submissions access to the revised rates without requiring researchers to resubmit them.

Models move into the red team

OpenAI says its security team has already used AI tools to uncover a P1 vulnerability, its highest severity classification. The flaw could let an attacker take over a signed-in user’s account after the victim opened a shared-conversation link. OpenAI patched the issue.

Project Daybreak extends that approach to a vetted community of outside security researchers. Participants receive access to advanced OpenAI models for vulnerability research, and OpenAI says the community used its latest model to identify a critical software bug. The program turns model-assisted testing into a recurring process rather than a one-time exercise.

The company has also expanded its security leadership. OpenAI hired former Palantir chief information security officer Dane Stuckey to work alongside security chief Matt Knight. Its sprint announcement describes a repeated cycle of authorized testing, remediation, and retesting.

The rules for researchers

OpenAI reserves its highest rewards for findings that demonstrate concrete agentic abuse or platform-integrity risks. Agentic systems allow models to take actions through tools, such as calling APIs, accessing files, or updating external services, which can increase the impact of a security failure.

• Simple jailbreaks, meaning prompts that bypass content restrictions without a demonstrated safety or abuse impact, remain outside the program’s scope.
• Outputs containing rude language or easily searchable public information do not qualify as safety vulnerabilities.
• Agentic-risk findings must reproduce in at least 50% of attempts to qualify for the highest payouts.
• Reports should document prerequisites, test conditions, trial counts, observed impact, and steps for reliable reproduction.

Integrations carry the blast radius

The Cathedral-Anthropic incident shows how external software can provide a route into an AI company’s internal systems. Teams connecting agents to Jira, Slack, Notion, customer databases, or other services inherit the permissions and security weaknesses of those integrations.

Developers deploying agents can reduce that exposure through a small set of concrete controls:

• Grant service accounts and OAuth tokens only the permissions required for each task.
• Separate development, testing, and production credentials.
• Store secrets outside prompts, logs, and model-visible files.
• Monitor tool calls and retain audit logs for investigation.
• Provide rapid token revocation and credential rotation.
• Review vendors’ disclosure, access-control, and incident-response practices.

OpenAI’s sprint formalizes model-assisted vulnerability research as an ongoing security operation. The larger bounties give outside researchers stronger incentives to report high-impact flaws, while the Cathedral partnership focuses attention on the third-party systems and integrations surrounding the models.