OpenAI brings in Cathedral for its next security sprint and lifts bug bounties to $172,000

What OpenAI announced

OpenAI said on 2 November 2026 that it is preparing its next internal security sprint, and that researchers from Cathedral Systems will take part. The company says Cathedral's researchers will use OpenAI's models alongside OpenAI's own security and product teams to challenge its defenses. The post does not give a start date, a duration or the systems in scope, and it does not say what Cathedral will be paid.

The sprint builds on an earlier one in which about a quarter of OpenAI's product engineers moved to security work, according to OpenAI and coverage by Help Net Security and Cybersecurity News. Engineers used Codex to investigate incoming reports, reproduce vulnerabilities in isolated environments and prepare patches for human review. OpenAI has not published a count of what that sprint found or fixed.

In a second post the same day, OpenAI raised its bug bounty rewards. A critical vulnerability in a core product such as ChatGPT, Codex or the API Platform now earns up to $30,000. Exceptional critical findings remain eligible for up to $100,000, and with new bonuses the total can reach $172,000. High-quality reports earn a multiplier on the base payout, and a five-tier loyalty program gives larger bonuses to researchers who keep reporting.

Who Cathedral is

Cathedral is a young AI security startup aimed at military and government work. Its founders, Gavin Kliger, Luke Farritor, Marko Elez and Jack Stein, previously worked at the Department of Government Efficiency, and Kliger later served as the Pentagon's chief data officer, according to reporting by Fast Company, Gizmodo and others.

The company drew attention in late October after The Washington Post reported on a draft report in which Cathedral said its AI agents broke into Anthropic's business systems in under 12 hours through weaknesses in third-party enterprise software. Anthropic confirmed access to a limited set of sales, HR and IT systems, including business contact details and some basic account records, and said Claude conversations, source code and model weights were not reached. Anthropic said it cut off access the same day, and that Cathedral overstated the national security angle and did not fully follow its bug bounty rules. Cathedral's draft claimed wider access, a claim Anthropic has not confirmed.

OpenAI's choice of the same team suggests it wants that kind of agent-driven, adversarial testing pointed at its own systems in a controlled exercise, rather than discovered through an outside report.

Why it matters and what to watch

AI labs now use their own models as both the tool and the target of security work. Anthropic has described Claude finding exploit chains in major browsers and operating systems, and outside researchers keep finding flaws in AI products, such as the ChatGPT shared link takeover that Parameter disclosed in October and that earned a $5,000 bounty. Higher rewards are meant to pull more of those findings into the program before attackers find them.

Several details remain open: when the sprint starts, which systems Cathedral may test, how findings will be disclosed and whether OpenAI will publish results afterwards. The new bounty levels apply to reports submitted through OpenAI's program; the posts do not say whether they apply to earlier reports. More coverage is in the Cybersecurity hub.

Questions people ask

How much does the OpenAI bug bounty pay?

Up to $30,000 for a critical flaw in ChatGPT, Codex or the API Platform, and up to $172,000 with bonuses for exceptional critical findings, according to OpenAI.

What is Cathedral Systems?

An AI security startup founded by former DOGE staff. It said in October that its AI agents broke into Anthropic business systems through third-party software, which Anthropic partly disputed.

When does the OpenAI security sprint start?

OpenAI has not given a date, duration or scope for the next sprint.

Sources

1. Preparing our next security sprint to harden OpenAI (OpenAI, 2 Nov 2026)
2. Rewarding defenders with bigger bug bounties (OpenAI, 2 Nov 2026)
3. OpenAI raises top bug bounty payout to $172,000 with bonuses (Help Net Security, 3 Nov 2026)
4. OpenAI Launches New Security Sprint to Hunt Vulnerabilities and Strengthen Defenses (Cybersecurity News, 2 Nov 2026)
5. Former DOGE staffers say they just hacked Anthropic in less than 12 hours (Fast Company, 27 Oct 2026)