What did OpenAI announce on November 2, 2026?
OpenAI published two security posts on November 2, 2026. One described its next internal security sprint. The other rewrote the reward structure of its Security Bug Bounty program.
A security sprint is an internal exercise, not an open bounty. OpenAI says it will bring new researchers and security partners together with its own teams. Together they will use OpenAI's models to test and strengthen the company's systems.
The named partner is Cathedral, a cyber startup that sells AI-driven security work. Cathedral's researchers will use OpenAI's models alongside OpenAI's teams to look for weaknesses and test fixes.
The two posts are linked but separate. The sprint is a company-run exercise with invited partners. The bounty is open to any researcher who follows the program rules.
OpenAI says Cathedral's researchers will bring "differentiated expertise and approaches to finding weaknesses." That phrase is the only explanation the post offers for the choice.
OpenAI did not publish a start date, duration or scope for the sprint. The posts do not say which products Cathedral will examine. They also do not say whether Cathedral is paid or how its findings will be audited.
The bounty changes are clearer. OpenAI says it is "more than quadrupling the midpoint of our reward ranges for medium, high, and critical findings on average." The sprint post uses a looser phrase, describing the change as more than quadrupling rewards for critical findings.
OpenAI frames the work as continuous defense. Its post argues that "traditional cyber defenses alone are no longer sufficient." The company points to recent industry incidents and to agents that can chain exploits faster than human teams respond.
Gavin Kliger, Cathedral's chief executive and co-founder, said the partnership would combine OpenAI's models and security expertise with Cathedral's research. He described the goal as finding weaknesses, testing fixes and strengthening continuous defense.
The timing matters. OpenAI has sold cyber models through Daybreak since June 2026, and it is now applying the same argument to its own infrastructure. The sprint is a test of whether the company will accept the scrutiny it asks defenders to accept.
OpenAI also says it will share its architecture and lessons from the prior sprint. It describes that material as a blueprint for cyber defenders in industry and government.
How much can a researcher earn for a critical OpenAI bug?
The base numbers are public. A critical vulnerability in a core product now earns up to $30,000. OpenAI names ChatGPT, Codex and the API Platform as core products.
Exceptional critical findings remain eligible for up to $100,000 before bonuses. OpenAI says they can reach up to $172,000 once bonuses are applied.
Three bonus systems sit on top of the base award. A quality multiplier rewards reports with a reliable proof of concept. A five-tier loyalty program adds scaling bonuses for repeat researchers. Priority campaigns carry dedicated pools for newly launched features.
The midpoint language matters. OpenAI is not saying every award quadrupled. It is saying the middle of each range rose by more than four times on average, while the ceiling rose less.
A critical finding in a core product now tops out at $30,000. The exceptional ceiling remains $100,000 before bonuses, which means the headline increase comes from multipliers rather than from the base table alone.
The published examples show how those multipliers compound. A quality bonus of 1.15x appears in every case. A priority campaign adds 1.30x where it applies. The loyalty tiers add between 1.05x and 1.15x.
That compounding explains the odd final figure of $171,925. OpenAI describes the ceiling as $172,000, while its worked example lands just below it.
OpenAI published worked examples with the post. A medium-severity ChatGPT issue that paid $750 now calculates to $2,415. A high-severity IDOR in a non-core asset that paid $1,000 now calculates to $3,162.50.
A one-click account takeover in ChatGPT that paid $6,500 now calculates to $51,577. An exceptional finding that lets an attacker read arbitrary users' chats shows $100,000 becoming $171,925.
The examples are illustrative, and most reports will not hit those ceilings. The critical base award is $30,000, not $172,000. The top figure requires an exceptional finding plus a strong proof of concept, a priority campaign and the highest loyalty tier.
OpenAI is also paying retroactively. Reports still awaiting an award will use the new ranges. Researchers paid in the 30 days before the announcement get the difference if the new formula would have paid more.
Scope still matters. The Bugcrowd program page lists ChatGPT, the OpenAI API, Codex and related services as in-scope targets. It also states that model issues are strictly out of scope and will not be rewarded.
That line separates software security from model behavior. A researcher who finds a flawed authorization check can be paid. A researcher who finds a prompt that produces harmful text cannot.
OpenAI will meet researchers at PROMPT2PWN in Oakland on November 20 and 21. The company says researchers can test targets in person at the event.
Who is Cathedral, and why is OpenAI working with it?
Cathedral is a New York City-based developer of AI-driven cyber warfare and defensive national security systems, according to FinSMEs. It is not a conventional bug bounty vendor.
TNW reported in July 2026 that Cathedral had raised $160 million at a $1.4 billion valuation. Andreessen Horowitz and Sequoia Capital co-led the round and took board seats, the outlet reported.
FinSMEs reported the same $160 million and $1.4 billion post-money valuation. It described the company as building tactical neural networks and automated threat detection for federal defense infrastructure.
The founders are Gavin Kliger, Luke Farritor, Marko Elez and Jack Stein. All four are former staffers at the Department of Government Efficiency, according to TNW. Kliger is described as a former Pentagon chief data officer.
TNW also reported that Cathedral planned to pursue U.S. government contracts for offensive and defensive cyber operations. The company was seeking a data center partner and had no disclosed revenue or contracts at the time.
TNW tied Cathedral's rise to a wider pattern. It said more than 250,000 people left the federal workforce during DOGE's cost-cutting campaign in 2025. Alumni of that campaign are now selling services back to the government they reshaped.
The same article noted Anduril's $5 billion raise at a $61 billion valuation. That figure shows how much capital is flowing into defense technology.
For OpenAI, the appeal may be speed and confidentiality. A specialist firm can test systems under tighter secrecy than an open bounty allows. An open program publishes scope and rules, but it cannot control who submits reports.
Those ties are relevant to the OpenAI deal. In July 2026, TNW reported that the White House had launched Gold Eagle, an AI-powered cyber vulnerability clearinghouse. Cathedral is positioning itself for exactly that kind of government work.
OpenAI's post does not explain why it chose Cathedral over an open bounty process. It says Cathedral brings different expertise and approaches to finding weaknesses.
The arrangement raises questions that OpenAI has not answered. Will Cathedral's researchers receive privileged access to source code or production systems? Who checks their work? Are they barred from testing the same systems for other clients?
There is also an independence question. A firm that sells cyber services to government agencies is now embedded in the defense of a company that also sells cyber tools to defense and law-enforcement organizations.
For critics, the risk is that a vendor with government ambitions becomes part of the review process without public visibility. That risk is structural, not personal.
None of this implies wrongdoing. It does mean that readers should treat the partnership as an undisclosed commercial arrangement until OpenAI says otherwise.
What did OpenAI's first security sprint achieve?
OpenAI has published more detail about the sprint that came before this one. Its Defense Factory page says the company mobilized more than 250 people and ran the work like an incident response.
A quarter of product engineers were assigned to finding and fixing weaknesses. Codex investigated findings, reproduced vulnerabilities in isolated environments and prepared patches for review.
The Defense Factory page describes five stages. Agents inventory systems, discover weaknesses, validate them dynamically, assign an owner and verify the remediation.
The tooling is specific. OpenAI lists Codex Desktop, Codex CLI and a Codex Security CLI. It also names two security models, Daybreak Blue and Daybreak Red.
Agents map cloud records and code owners, scan for weaknesses, reproduce findings in disposable environments and route fixes to the right team. People review consequential changes and verify deployed fixes.
The last stage requires evidence that a fix was deployed and retested. That is the stage OpenAI says exposed the gap.
OpenAI says teams closed 53 urgent or high-priority issues on the first day. That is the headline number the company chose to lead with.
The operational data is more mixed. Codex classified 37% of findings as duplicates. Only 19.5% of findings were reproduced at runtime.
After dynamic validation, the false-positive rate was 0.81%, according to OpenAI. Remediation was 100% Codex-based, and 90.6% of ownership assignments were accepted.
Those figures describe a system that generated a lot of leads and discarded most of them. A 37% duplicate rate and a 19.5% runtime reproduction rate are not signs of a clean pipeline. They are signs of noisy discovery.
OpenAI also admits a gap between merged patches and fixes deployed across its fleet. A ticket marked complete did not prove that every affected system was fixed.
That admission is the most useful benchmark for the Cathedral round. The right question is not how many findings the sprint produces. It is how many fixes are deployed and independently verified.
The numbers are also self-reported. The page does not publish the underlying dataset or an outside audit. Researchers should treat the Defense Factory page as a company case study, not an independent evaluation.
OpenAI says it is publishing its architecture and lessons from the sprint. It has not said whether it will publish comparable results for the next round.
Why are bug bounty programs struggling with AI-generated reports?
OpenAI is raising payouts while other bounty programs are cutting back. The contrast is instructive.
Google paused its Open Source Software Vulnerability Rewards Program on October 1, 2026. TechCrunch reported that Google blamed a "significant rise in automated submissions, the vast majority of which are not valid."
Google said it would post an update in the first quarter of 2027. The pause followed warnings that AI-generated reports were overwhelming maintainers with plausible but useless findings.
TechCrunch cited Tom's Hardware's reporting that Google engineers and open-source maintainers were overwhelmed by invalid reports and hallucinations.
OpenAI's answer is not to pause. It is to pay more for the reports it wants and less, relatively, for the rest.
That approach depends on triage capacity. Every extra submission costs reviewer time, even when it earns no bounty.
OpenAI's agents do part of the first pass. Codex assessed batches against a severity rubric and added service and owner context, according to the Defense Factory page.
OpenAI's sprint data shows a related signal problem inside its own pipeline. More than a third of findings were duplicates, and fewer than one in five reproduced at runtime.
The new quality multiplier targets the same problem. It pays more for reports that isolate a bug, show when it can be exploited and demonstrate impact. A vague write-up earns less.
Loyalty bonuses add a second filter. Researchers with a track record get larger multipliers, which gives OpenAI a reason to prioritize known reporters over anonymous floods.
Priority campaigns create a third lever. OpenAI can concentrate attention and money on a new feature during the window when it is most exposed.
Bigger headline bounties could still attract more speculative reports. The maximum payout is a headline number. The quality gate is what determines whether the program produces fixes.
There is a deeper economic point. AI lowers the cost of finding bugs and the cost of generating noise. A bounty program has to price validation, not just discovery. OpenAI's multipliers are an attempt to do that.
Whether it works will show up in duplicate rates, reproduction rates and deployed fixes. OpenAI has not committed to publishing those numbers for the next sprint.
What should researchers and defenders watch next?
The first item is the sprint's start date and scope. OpenAI has not published either, so the timeline is unknown.
The second is deployment data. OpenAI's own case study separates merged patches from verified remediation. The next report should be judged on the same standard.
The third is Cathedral's access. A single outside firm working inside OpenAI's teams is different from an open bounty. Researchers will want to know what systems it can see and who audits its findings.
A related question is disclosure. The posts do not describe a process for publishing findings from the sprint. The bounty program has public rules, while the sprint does not.
A finding that stays internal can still be fixed. It cannot be checked by outside researchers, which makes the company's own account the only record.
The fourth is money. OpenAI committed $1 billion in subsidized Daybreak access over six months, announced on September 3, 2026. The company says 2,000 approved organizations and workspaces already use Daybreak, as of the September announcement.
That commitment is separate from the Cathedral sprint. It covers frontline defenders, including water utilities, grid operators, local governments and community banks.
The fifth is competition. If OpenAI's larger bounties produce better reports, other model labs may face pressure to match them. If they produce noise, Google's pause may look like the more prudent choice.
The sixth is policy. Cathedral's government ties and OpenAI's defense work sit inside a broader debate about who gets access to frontier cyber models. The $1 billion Daybreak program is part of that debate.
For researchers, the practical advice is unchanged. A clear proof of concept and a reproducible exploit are worth more than a long report. The new multipliers reward exactly that.
For defenders, the lesson is that discovery is the easy part. OpenAI closed 53 urgent issues on day one of its last sprint. It still had to admit that some merged fixes were not deployed.
The November 2 announcement raises the price of finding bugs. The harder problem is making sure the fixes reach every system that needs them.