---
title: OpenAI raises bug bounties: critical bugs in ChatGPT, Codex or the API now pay up to $30,000, exceptional ones up to $172,000 with bonuses, and Cathedral will join its next internal security sprint | ctxsec
url: https://ctxsec.com/items/openai-bug-bounty-4x-critical-172k-cathedral-security-sprint
description: "OpenAI said on Nov 2 it is more than quadrupling the midpoint of its reward ranges for medium, high and critical findings. A critical bug in a core product such as ChatGPT, Codex or the API Platform now earns up to $30,000; exceptional critical findings stay eligible for up to $100,000 base and up to $172,000 with new quality, loyalty and priority-campaign multipliers. The new ranges apply to unawarded reports and top up awards from the prior 30 days. Separately, OpenAI said Cathedral researchers will use OpenAI models alongside its teams in its next internal security sprint."
status: "official (OpenAI posts, Nov 2)"
published: 2026-11-02
---

> OpenAI said on Nov 2 it is more than quadrupling the midpoint of its reward ranges for medium, high and critical findings. A critical bug in a core product such as ChatGPT, Codex or the API Platform now earns up to $30,000; exceptional critical findings stay eligible for up to $100,000 base and up to $172,000 with new quality, loyalty and priority-campaign multipliers. The new ranges apply to unawarded reports and top up awards from the prior 30 days. Separately, OpenAI said Cathedral researchers will use OpenAI models alongside its teams in its next internal security sprint.

[← AI](/ai) · [markdown](/items/openai-bug-bounty-4x-critical-172k-cathedral-security-sprint.md)

official (OpenAI posts, Nov 2)

2026-11-02

### OpenAI raises bug bounties: critical bugs in ChatGPT, Codex or the API now pay up to $30,000, exceptional ones up to $172,000 with bonuses, and Cathedral will join its next internal security sprint

- **Multipliers:** a quality bonus for reports with a reliable, isolated proof of concept; a five-tier loyalty bonus; and priority campaigns with bonus pools for newly launched features. OpenAI's worked example for an exceptional ChatGPT boundary break (reading arbitrary users' chats) comes to $171,925.
- **Retroactive:** pending reports get the new ranges; awards in the 30 days before the announcement are topped up if they would have earned more.
- **Security sprint:** OpenAI says its last sprint put 25% of product engineers on finding and fixing weaknesses, using Codex to reproduce bugs in isolated environments and prepare patches. Cathedral is the startup whose agents reportedly reached Anthropic business systems in an authorized test last month.
- **In person:** OpenAI's security team will be at PROMPT2PWN in Oakland on Nov 20-21.

Sources: [OpenAI: Rewarding defenders with bigger bug bounties (Nov 2)](https://openai.com/index/rewarding-defenders-with-bigger-bug-bounties) · [OpenAI: Preparing our next security sprint to harden OpenAI](https://openai.com/index/preparing-our-next-security-sprint-to-harden-openai/)