OpenAI Red-Teams Itself With Its Own Models and Quadruples Bug Bounty Rewards: What Changes for Coding Agents
OpenAI's November 2, 2026 announcements: a security sprint with Cathedral that runs OpenAI's own models against its own defenses, plus bug bounty midpoints up more than fourfold. What changes for teams running coding agents.
OpenAI published two security announcements on November 2, 2026, and they only make sense as one story. The company will run its next internal security sprint with the security firm Cathedral, running OpenAI’s own models against OpenAI’s own defenses. And it is raising what it pays outside researchers for bugs in its software, lifting the midpoint of its medium, high and critical reward ranges more than fourfold on average.
The pairing is the story. A red-team exercise is a project. A red-team program priced like a market is a supply chain, and OpenAI just published what it thinks that supply chain costs.
What OpenAI actually said
In “Preparing our next security sprint to harden OpenAI”, OpenAI says it is bringing “new researchers and security partners together with our own teams to use our models to test and strengthen our systems.” Cathedral’s researchers will use OpenAI’s models alongside OpenAI’s own teams to challenge its defenses. Gavin Kliger, CEO and co-founder of Cathedral, is quoted saying OpenAI “is setting an important example by partnering with outside security firms and using its own models to continuously test and strengthen our defenses.”
The post also reports the receipts from the sprint before it. OpenAI says it dedicated 25% of its product engineers to finding and fixing weaknesses, and used Codex to investigate findings, reproduce vulnerabilities in isolated environments and prepare patches for review. It says it is making its most capable models available to Daybreak customers, has committed $1 billion in subsidized access over six months for frontline defenders, and is sharing the architecture and lessons from the last sprint.
Both posts appear on OpenAI’s news index as November 2, 2026 entries. A same-day announcement dump is not a story by itself, so what follows is about the numbers and the loop rather than the launch calendar.
What the money looks like
The bug bounty announcement is the more concrete of the two. OpenAI is more than quadrupling the midpoint of reward ranges for medium, high and critical findings on average. A critical vulnerability in a core product such as ChatGPT, Codex or the API Platform now earns up to $30,000. Exceptional critical findings on those targets stay eligible for up to $100,000, and now up to $172,000 once bonuses apply.
The base award is only the floor, and OpenAI’s own worked examples show the arithmetic:
| Example finding | Historical award | New calculation | New payout |
|---|---|---|---|
| Medium, ChatGPT core asset: read-only member uploads to a Project without write permission | $750 | $2,000 x 1.15 quality x 1.05 bronze loyalty | $2,415 |
| High, Prism non-core asset: IDOR reading a file uploaded to a user’s Project | $1,000 | $2,500 x 1.15 quality x 1.10 gold loyalty | $3,162.50 |
| Critical, ChatGPT core asset: one-click account takeover | $6,500 | $30,000 x 1.15 quality x 1.30 priority campaign x 1.15 tier 31337 loyalty | $51,577 |
| Exceptional, ChatGPT core asset: compromise of a security boundary, for example viewing other users’ chat messages | $100,000 | $100,000 x 1.15 quality x 1.30 priority campaign x 1.15 tier 31337 loyalty | $171,925 |
OpenAI notes that all scenarios and historical awards are illustrative. Even so, the shape matters: a one-click account takeover in ChatGPT moved from $6,500 to a $51,577 ceiling, because the base range moved and three bonuses landed at once.
The four pieces point at different behavior. The quality multiplier rewards a proof of concept that isolates the bug, shows when it can be exploited and demonstrates its impact. The loyalty program is a five-tier ladder that scales bonuses for researchers who keep coming back. Priority campaigns run dedicated bonus pools against newly launched features for a limited window. And the new base range sets the floor.
Two logistics matter if you have filed reports. OpenAI says reports already submitted but not yet awarded will be paid under the new ranges, and that for bounties awarded in the 30 days before the announcement it will pay the difference where the finding would have earned more under the new base and loyalty awards. Its security team will also be at PROMPT2PWN in Oakland on November 20 and 21, where researchers can test targets in person.
What changes if you run agents in production
Assume continuous machine-speed probing of anything an agent can reach. OpenAI is doing this to its own products with its own models plus an outside firm, and paying outside researchers more than four times the old midpoint for the same class of work. Anthropic red-teaming its own training-data monitor and Bank of America on what patching AI-found flaws cost it are the same curve seen from the model side and the victim side. The operational consequence: treat every path a coding agent can reach as under continuous test by someone else’s models, and scope credentials and network reach on that assumption.
Read priority campaigns as a public map of the blind spots. Each one targets newly launched features. A feature with an active bonus pool is a feature with recently shipped changes and thin test coverage. That is a signal most operators will never find in a changelog.
Decide whether to file. With the top-up window open and effective rates at more than four times the old midpoint, a researcher holding a known IDOR or account-takeover path has a concrete reason to run it now, before the target changes or disappears.
Check that the target still exists. One of OpenAI’s own examples is Prism, a non-core asset. We have already reported that Prism shuts down on January 1, 2027. A bounty table that mixes a live target with a dying one is a reminder to confirm an asset’s status before spending a week on reproduction.
The loop being sold
The sprint post frames all of this as a continuous defensive loop: find, reproduce in isolation, patch, review, repeat.
OpenAI says it is sharing the architecture and lessons from the last sprint, and it points defenders at a runbook we published for what to do when a model crosses a critical cyber threshold. We have also covered how OpenAI handled the training policy for Daybreak sessions.
If OpenAI does publish how its models found weaknesses in its own defenses, that write-up is the more consequential of the two announcements. Defense recipes that used to be secret become templates. The bounty numbers tell you what a finding is worth. The sprint write-up tells you where to look.
