OpenAI Quadruples Bug Bounty Payouts and Turns Its Own Models on Itself

OpenAI has more than quadrupled rewards for critical findings in its Security Bug Bounty program as it prepares its next internal security sprint — an effort that will pair its own teams with outside researchers using OpenAI's models to attack the company's defenses.

The company announced the changes in a post titled "Preparing our next security sprint to harden OpenAI," describing a program that goes beyond a conventional bug bounty. Outside security researchers won't just file reports. They will work alongside OpenAI's teams, running OpenAI's own models against OpenAI's own systems to find weaknesses before malicious actors do.

The designated partner for this sprint is Cathedral, a security firm whose researchers will use OpenAI's models alongside internal teams "to challenge our defenses, bringing differentiated expertise and approaches to finding weaknesses and helping us protect our platforms."

That framing matters. OpenAI is treating its frontier models not just as products to defend, but as offensive security tools — instruments that can probe, stress and break the very platforms they run on. The takeaway: OpenAI now sees its own AI as the core instrument of its own defense.

What changes in the bug bounty program?

The headline change is money. OpenAI said it is "more than quadrupling our rewards for critical findings," a jump designed to pull top-tier vulnerability research toward its platforms at a moment when the stakes of an AI provider's security are rising industry-wide.

The program's purpose is also being reframed. OpenAI wants researchers "to challenge our assumptions and help strengthen both our systems and the methods we use to defend them" — a hint that the company is testing not only its code but its defensive doctrine.

For the security research community, the message is direct: critical findings against OpenAI are now worth substantially more, and the company is inviting adversarial scrutiny rather than merely tolerating it. In short, OpenAI is paying more and opening wider.

What did the last sprint actually achieve?

OpenAI pointed to its previous internal security sprint as proof the model-driven approach works. During that sprint, the company dedicated 25% of its product engineers to finding and fixing weaknesses in its systems — a quarter of the entire product engineering organization redirected to security work.

The workflow was concrete. "Using Codex, engineers investigated findings, reproduced vulnerabilities in isolated environments and prepared patches for review," the company said. Codex, OpenAI's coding model, sat at the center of a loop: triage a finding, rebuild the vulnerability safely in a sandbox, then draft the fix for human review.

That loop is the mechanism worth understanding. Instead of security as a periodic audit, OpenAI describes "continuous defensive loops to find and fix weaknesses before attackers do" — automation compressing the time between discovery and patch. The last sprint showed a quarter of the engineering staff, armed with Codex, could run that loop at scale.

Why is OpenAI doing this now?

The company's own explanation is blunt: "traditional cyber defenses alone are no longer sufficient." OpenAI cited "recent incidents across the industry" as evidence of "how quickly threats can emerge," without naming specific breaches.

The context is broader than one company. AI providers have become critical infrastructure for millions of developers and businesses, and the models themselves can be turned to offensive uses — finding vulnerabilities, writing exploit code, automating reconnaissance. OpenAI's argument is that this same capability must be weaponized for defense: "Keeping the defender's window open requires organizations to use frontier cyber capabilities to harden their systems."

The "defender's window" is the gap between a vulnerability existing and an attacker exploiting it. AI, in OpenAI's telling, can widen that window for defenders — or slam it shut if only attackers use it. That asymmetry is why the company says it is "using our most capable models to strengthen our own defenses."

What is OpenAI offering outside defenders?

The sprint sits inside a larger package of commitments aimed at security teams beyond OpenAI's walls.

• Subsidized frontier access. OpenAI has committed $1 billion in subsidized access over six months for frontline defenders protecting essential services and digital infrastructure, channeled through its Daybreak program for customers.
• Shared architecture. The company is publishing details of its own security architecture and lessons learned from the last sprint.
• A public blueprint. OpenAI is sharing "our blueprint for empowering cyber defenders across industry and government."

The $1 billion figure is the anchor. Six months of subsidized access to frontier models, aimed specifically at defenders of critical infrastructure, signals that OpenAI wants its systems in the hands of security teams as standard tooling — not just developers. The takeaway: OpenAI is positioning model access itself as a national-scale defensive resource.

Who gets the capabilities — and who doesn't?

There is a deliberate gate in OpenAI's language. The company says it will keep "expanding access for trusted defenders." Frontier cyber capabilities, in this framing, are a privilege distributed to vetted actors, not an open resource.

That position cuts against the open-security research tradition, where capabilities are published so everyone can defend. OpenAI's counterargument is implicit in the post: attackers are already moving fast, and handing offensive-capable systems to everyone widens their window too.

Expect this tension — open research versus trusted access — to define how the Daybreak subsidies and the Cathedral partnership are received by the wider security community.

What happens next?

OpenAI's stated path forward has three tracks: keep advancing the models, keep using them against its own systems, and keep expanding access for trusted defenders.

The company's closing argument raises the stakes beyond its own perimeter: "Keeping the defender's window open will take action across the industry, and that work needs to start now." That is both a commitment and a call to competitors, enterprises and governments to adopt AI-driven defensive loops of their own.

The next sprint, with Cathedral's researchers embedded and quadrupled bounties on the table, will be the first public test of whether that urgency produces results. If the pattern holds, expect other AI labs to follow — because in OpenAI's telling, the alternative isn't the status quo, it's attackers holding the better model.