OpenAI Will Now Pay Up to $172,000 for the Worst ChatGPT Bugs
OpenAI has more than quadrupled its bug bounty rewards, with up to $172,000 for the worst ChatGPT flaws, and hired Cathedral, the start-up that got inside Anthropic, to test its defences.
$171,925. That is what OpenAI now says it could pay one outside researcher for a flaw that lets someone read any ChatGPT user’s chats. The company raised its bug bounty rewards on Monday and said it is bringing in Cathedral, the start-up that got inside parts of Anthropic’s systems last month, to attack its own defences.
A bug bounty is a standing offer of cash to people who find security holes and report them privately instead of exploiting them. In its announcement, OpenAI said it is “more than quadrupling” the midpoint of its reward ranges for medium, high and critical findings, on average. A critical bug in ChatGPT, Codex or its developer platform now pays up to $30,000. The rarest, most serious finds can still earn up to $100,000 before bonuses, and up to $172,000 with them.
What the new rates look like
OpenAI gave examples, which it calls illustrative. A one-click ChatGPT account takeover that once earned $6,500 would now pay $51,577 with every bonus stacked. A medium bug that let a read-only team member upload files to a Project goes from $750 to $2,415.
The bonuses come from three new multipliers: one for high-quality reports with a working proof, a five-tier loyalty scheme for repeat researchers, and short campaigns with extra money for newly launched features. Reports still waiting for payment get the new rates, and anyone paid in the previous 30 days gets the difference. The programme runs on Bugcrowd.
Hiring the firm that got into Anthropic
In a separate post, OpenAI said Cathedral’s researchers will use OpenAI’s models alongside its own teams in its next internal security sprint. Cathedral chief executive Gavin Kliger said OpenAI was “setting an important example” by working with outside firms.
Cathedral, founded by four former DOGE staffers, said its AI agents found paths into Anthropic’s Slack messages, meeting transcripts and salary records in under 12 hours, The Washington Post reported on 26 October. Anthropic said only “a limited set” of its sales, HR and IT systems were reached, and that Claude chats, source code and model weights were not. It also said Cathedral didn’t disclose all of its activity under the bounty rules, Decrypt reported. OpenAI’s posts don’t mention any of this.
In its last sprint, OpenAI said, it put 25% of its product engineers on finding and fixing weaknesses, using its Codex coding agent. Neither company has said when the new one starts or what Cathedral will be paid.
Why it matters
Bigger rewards make it more likely that the next hole in ChatGPT is reported to OpenAI rather than sold or used. That matters to anyone who keeps personal or work material in their chats, which can leak through bugs like the shared-link flaw we reported on Monday.
