On this page
OpenAI posted on X at 2026-11-03 02:29:35 UTC, which is 2026-11-03 10:29:35 Asia/Shanghai, that it is planning its next internal security sprint and raising Security Bug Bounty rewards. The account is @OpenAI. Two OpenAI blogs carry a page date of November 2, 2026—one on the sprint, one on the bounty raise. Those blog dates and the X post time sit side by side; they are not the same moment.
The main post frames the move as putting AI to work for defenders before attackers do: partnering with Cathedral Systems, whose researchers will use OpenAI’s models alongside OpenAI teams to challenge defenses, and raising bounty rewards, including more than quadrupling rewards for critical findings. It also states that exceptional findings will be eligible for up to $172,000, including bonuses. A follow-up reply in the same thread covers make-up payments for awaiting reports and for awards paid in the past 30 days.
Related reading: Codex Usage Shows gpt-6.2-astra Before Any Official Listing, ChatGPT Pro and Business Can Claim Up to $500 Monthly API Credits, METR and Redwood Red-Teamed OpenAI's Internal Agent Monitoring, and OpenAI Tightens Isolation for Frontier Model Training.
Next internal security sprint
The sprint blog is titled Preparing our next security sprint to harden OpenAI. OpenAI writes that it is planning the next internal security sprint, bringing new researchers and security partners together with its own teams to use its models to test and strengthen systems. The named partner is Cathedral Systems: its researchers will use OpenAI’s models alongside OpenAI teams to challenge defenses. The same blog quotes Gavin Kliger, CEO & Co-founder of Cathedral Systems, and also notes bounty-program improvements, including more than quadrupling rewards for critical findings.
As context for the next round, OpenAI says the last sprint dedicated about 25% of product engineers to finding and fixing weaknesses. Using Codex, engineers investigated findings, reproduced vulnerabilities in isolated environments, and prepared patches for review. In the same hardening narrative, OpenAI says it is making capable models available to Daybreak customers and has committed $1 billion in subsidized access over six months for frontline defenders. That $1 billion line is subsidized access in the sprint blog’s hardening story—not a Security Bug Bounty payout figure.
Security Bug Bounty raise
The bounty blog is titled Rewarding defenders with bigger bug bounties. OpenAI’s wording on the range lift is precise: it is more than quadrupling the midpoint of its reward ranges for medium, high, and critical findings on average. That is a midpoint / on-average statement for those severity bands—not a claim that every tier is an exact ×4.
For core products, a critical vulnerability in ChatGPT, Codex, or the API Platform will now earn up to $30,000. Exceptional critical findings on those targets remain eligible for up to $100,000, and now up to $172,000 with bonuses. Those exceptional ceilings are eligibility / reach figures with bonuses; OpenAI’s blog marks scenarios as illustrative.
Bonuses, an illustrative example, and make-ups
The bounty blog lists three bonus tracks: high quality report multipliers; a 5-tier loyalty program; and priority campaign multipliers for newly launched features. An illustrative payout table walks an Exceptional — ChatGPT (core asset) row to $171,925 via $100,000 × 1.15 Quality × 1.30 Priority Campaign × 1.15 31337 loyalty. The page labels scenarios and historical awards as illustrative. DigIntoAI records $171,925 as that OpenAI blog example.
Make-up rules (bounty blog and X follow-up): reports already submitted that have not yet been awarded a bounty get the new reward ranges; bounties awarded in the 30 days before the announcement get the difference if the finding would have earned more under the new ranges (Base Award + Loyalty Awards). OpenAI also notes that on November 20–21 its security team will be at PROMPT2PWN in Oakland. Program detail links out from the bounty blog.
DigIntoAI hasn't re-run the bounty math
DigIntoAI hasn't re-run the bounty math, and hasn't reproduced vulnerabilities. The facts above follow the original blogs and X posts.
Quick facts
- Who. OpenAI — sprint blog, bounty blog, and @OpenAI on X.
- When. Blog page dates November 2, 2026; main X post 2026-11-03 10:29:35 Asia/Shanghai (2026-11-03 02:29:35 UTC); follow-up …10:29:36 Asia/Shanghai.
- Sprint. Next internal security sprint; partner Cathedral Systems; researchers use OpenAI models with OpenAI teams to challenge defenses.
- Last sprint (blog context). About 25% of product engineers; Codex for investigate / isolated reproduce / patch review.
- Bounty midpoint. More than quadrupling midpoints for medium, high, and critical on average.
- Core critical. ChatGPT / Codex / API Platform critical up to $30,000; exceptional eligible up to $100,000, now up to $172,000 with bonuses.
- Make-up. Awaiting awards on new ranges; past-30-day awards may get Base + Loyalty difference.
- Hands-on. DigIntoAI hasn't re-run the bounty math or reproduced vulnerabilities.
In short
OpenAI’s 2026-11-03 morning Asia/Shanghai X thread, paired with two November 2, 2026 blogs, announces a next internal security sprint with Cathedral Systems using OpenAI models to pressure-test defenses, and a Security Bug Bounty raise that more than quadruples midpoints for medium, high, and critical findings on average. Core-product critical awards go up to $30,000, with exceptional critical findings eligible for up to $172,000 with bonuses—an eligibility figure illustrated on the blog by an example path to $171,925. Make-up rules cover awaiting awards and some payouts from the prior 30 days. Official hardening and bounty-policy update from OpenAI.