OpenAI says bounties go up to $172,000 with bonuses and a Cathedral sprint is planned; no scope, date or count

OpenAI's top example pays 1.72 times its old top award, and none of the rise comes from the base

OpenAI's bounty page works one example through to $171,925. The base is $100,000, the same figure the page says exceptional critical findings on its core products already could reach, and three multipliers are stacked on it: 1.15 for report quality, 1.30 for a priority campaign and 1.15 for the top loyalty tier. $100,000 × 1.15 × 1.30 × 1.15 = $171,925 (derived, and it matches the printed figure). Against the $100,000 historical award in the same row that is 1.72 times (derived: 171,925 divided by 100,000). All of that rise comes from the multipliers. The base did not move.

That is a smaller number than the phrase "more than quadrupling" suggests, and the gap is the subject of this briefing. The bounty page applies that phrase to "the midpoint of our reward ranges for medium, high, and critical findings on average". The ranges themselves are not printed on the page, so the claim cannot be checked from it. The sprint page uses a looser wording, "more than quadrupling our rewards for critical findings". Those are two different statements, made on the same day by the same company.

OpenAI published the two linked pages on 2 November 2026. This briefing was built on Wednesday 4 November 2026 from saved copies of both, captured in a real browser tab at 07:46 UTC that morning; the pages are at the sprint page and the bounty page. Both are OpenAI's own account of its own programme, and OpenAI sells the models it says it uses for defence and offers to defenders. Nothing here was checked against an independent source, and none of the other OpenAI pages the two link to was read. Where a fact sits on one of those pages, this briefing says only that the link exists.

What the pages do not establish is most of what a security team would want to ask. The sprint page does not say how many vulnerabilities the last sprint found, what the next one will test, or when it will run. The bounty page does not give the new ranges in full. The payout examples are labelled illustrative by OpenAI itself. The sections below set out the arithmetic, the stated and not stated record, and what to ask.

The page's own payout table, recomputed

The bounty page prints four worked examples, each with an example historical award, an example new calculation and a new reward. It then states: "All scenarios and historical awards are illustrative." The first table divides the new reward by the historical award in each row. Every ratio is derived by this site, rounded to two places, and applies to the example only, not to the program.

OpenAI's four illustrative payout examples as printed on the bounty page (2 November 2026), with the new reward divided by the historical award. The last column is derived by this site.

Example as printed	Historical award	New reward	New divided by old (derived)
Medium, ChatGPT (core asset): a read only member can upload files to a Project without write permission	$750	$2,415	3.22 times
High, Prism (non core asset): an insecure direct object reference reading a file uploaded to a user's Project	$1,000	$3,162.50	3.16 times
Critical, ChatGPT (core asset): zero click account takeover	$6,500	$51,577	7.93 times
Exceptional, ChatGPT (core asset): significant compromise of a security boundary, such as viewing arbitrary users' chat messages	$100,000	$171,925	1.72 times

The second table strips out the multipliers to see what the base alone does. The base column is the figure at the start of each printed calculation.

The same four examples with the multiplier chain printed on the bounty page, the product recomputed by this site, and the base compared with the historical award (derived).

Example	Printed chain	Product (derived) against printed	Base divided by old (derived)
Medium	$2,000 × 1.15 quality × 1.05 Bronze loyalty	$2,415.00 against $2,415	2.67 times
High	$2,500 × 1.15 quality × 1.10 Gold loyalty	$3,162.50 against $3,162.50	2.50 times
Critical	$30,000 × 1.15 quality × 1.30 priority campaign × 1.15 loyalty (top tier, printed as 31337)	$51,577.50 against $51,577	4.62 times
Exceptional	$100,000 × 1.15 quality × 1.30 priority campaign × 1.15 loyalty (top tier, printed as 31337)	$171,925.00 against $171,925	1.00 times

Three readings follow. The first two are arithmetic. The third is inference.

First, the multiplier chain on the two largest examples is 1.15 × 1.30 × 1.15 = 1.71925 (derived). That is an uplift of about 72 per cent on whatever the base is, and it applies only to a report that earns the quality bonus, falls in a priority campaign and comes from a top tier researcher at once. The page does not say how common that combination is. On the medium and high examples the chain is 1.2075 and 1.265 (derived), a modest uplift on a base that did rise.

Second, only one of the four examples shows a base that more than quadruples: the critical example, at 4.62 times (derived). The medium and high bases rise 2.67 and 2.50 times (derived), and the exceptional base is unchanged. Four examples chosen and labelled illustrative by the seller cannot test a claim about the midpoint of every range on average. They are consistent with a large rise at the critical level and a smaller one below it, and that is all.

Third, a small point about rounding, offered as inference. The critical product is $51,577.50 and the page prints $51,577, which suggests the figure was cut down to whole dollars rather than rounded up. The page headline figure of up to $172,000 with bonuses is the exceptional example of $171,925 rounded to the nearest thousand (derived: $75 higher). The page does not say $171,925 is the cap, and it does not print any multiplier above 1.15 for quality, 1.30 for a campaign or 1.15 for loyalty.

Zoom

What the two pages state, and what they leave out

The sprint page is short. It describes a plan, a partner and a funding commitment, and it gives one number about the past: "We dedicated 25% of our product engineers to finding and fixing weaknesses in our systems." It adds that engineers used Codex to investigate findings, reproduce vulnerabilities in isolated environments and prepare patches "for review". The table separates what is printed from what is not.

Stated and not stated, from the two OpenAI pages dated 2 November 2026. The left column is the topic, the middle is what the pages print, the right is what they do not print.

Topic	What the pages state	Not stated on either page
The last sprint	25% of product engineers dedicated to finding and fixing weaknesses; Codex used to investigate findings, reproduce them in isolated environments and prepare patches for review.	How many vulnerabilities were found, how severe, how many fixed, how fast, and how many engineers 25% is.
The next sprint	OpenAI is "planning our next internal security sprint" with new researchers and security partners alongside its own teams.	A start date, an end date, a length, the systems in scope, the rules for the partner, and a measure of success.
Cathedral	Named as the partner; its researchers "will use OpenAI's models alongside our teams". The page prints a supportive quote from Cathedral's chief executive.	Any fee or terms, the number of researchers, and whether either side will publish findings.
Recent incidents	The page says "Recent incidents across the industry" show how fast threats emerge.	Which incidents. None is named.
Defense Factory	The bounty page describes it as work where engineers use models to find weaknesses, reproduce them and test fixes. Both pages link to a Defense Factory page of OpenAI's.	Any results. That linked page was not read for this briefing.
The $1 billion	"$1 billion in subsidized access over six months" for frontline defenders protecting essential services and digital infrastructure, in the same passage as making OpenAI's most capable models available to Daybreak customers.	How the access is valued, who qualifies, how many defenders, and whether any of it is cash. The linked page was not read.
Reward ranges	Midpoint of the ranges for medium, high and critical "more than quadrupling" on average; a critical in a core product up to $30,000; exceptional criticals up to $100,000, and up to $172,000 with bonuses.	The full ranges, the old and new midpoints, how the average was taken, and the ranges for low severity findings.
Multipliers	A quality multiplier, a five tier loyalty bonus and priority campaign multipliers. The examples print 1.15 quality, 1.30 campaign, and loyalty at 1.05 (Bronze), 1.10 (Gold) and 1.15.	The quality criteria beyond a proof of concept description, the names and rules of the other two loyalty tiers, campaign dates and any cap.
Retroactive pay	A submitted report not yet awarded gets the new ranges. Awards made in the 30 days before the announcement are topped up by the difference, in brackets "Base Award + Loyalty Awards".	Whether the quality and campaign multipliers count in a top up, and how many reports this touches.
Where the program lives	The bounty page links its program to a bugcrowd.com engagement. The sprint page links the same words to an openai.com page.	What the program rules say. Neither link was opened for this briefing.

Note the two link targets in the last row. The page text is the same, "Security Bug Bounty program", and the link list saved from each page points to a different place. This site cannot say why. It matters only because a researcher wanting the full ranges should start from the program page itself, not from any summary, including this one.

Who is affected, and the dates the pages give

The page names three core products: ChatGPT, Codex and the API Platform. A critical vulnerability in one of them "will now earn up to $30,000". The medium and high examples include a core asset and a non core asset, Prism, so the page implies that non core targets are covered by the same program, with their own ranges. It does not print those ranges.

Two dates matter to a researcher. Bounties awarded "in the 30 days before this announcement" are eligible for a top up. If the announcement date is the page date of 2 November 2026, that window starts on 3 October 2026 (derived: 30 days earlier). The page does not define the announcement date, so confirm it with the program. And OpenAI's security team will be at PROMPT2PWN in Oakland on 20 and 21 November, which is 16 days after the day this briefing was built (derived). The page says researchers "can test targets in person" there. It does not say which targets, which rules apply, or whether the new multipliers apply to what is found at the event.

A note on the loyalty system: the page says there are five tiers and prints three multipliers. Reading them in order, 1.05, 1.10 and 1.15, suggests the scale rises with tier, but the page does not say that the tiers it names are the lowest, the middle and the highest, and it does not name the other two. That is inference.

Whose account this is

Both pages are OpenAI's. The company runs the bounty, sets its ranges, sells the models it says it uses, and offers those models to defenders through Daybreak. The sprint page presents the programme as a demonstration of that approach. None of this implies bad faith. It does mean that every sentence about results is the seller describing its own work, and the result that would matter most, the count of weaknesses found and fixed, is absent.

The only outside voice on the sprint page is the chief executive of the partner it names, who says in the page's quoted words that "Every company should be thinking about how to put these capabilities to work". It is a statement from a party that is working with OpenAI on this sprint, and the page prints no payment terms. It is not independent evidence about how well the approach works.

One neutral note for readers who follow the sector. Cathedral is also the subject of a separate matter between that firm and Anthropic, covered in this site's earlier briefing. That briefing is an attribution map of a dispute whose documents are not public. This briefing takes no side in it, draws no connection between the two matters, and nothing on OpenAI's pages mentions it.

Two earlier briefings give context on OpenAI's defensive programmes: one on Patch the Planet, a Daybreak initiative, and one on an OpenAI executive on the flood of AI generated bug reports, which reports the Daybreak page's $1 billion subsidised access figure and notes that OpenAI's pages print patch counts without a period. Neither contradicts anything above. The sprint page lists Patch the Planet among its related reading.

What to ask, in order

The question that exposes the gap: when OpenAI's next sprint with Cathedral ends, who outside the two companies will be able to check how many weaknesses it found, how serious they were, and how quickly they were fixed?

Key facts