# OpenAI Adds Hacktron After Cathedral as Outside Teams Test Its Systems, and Raises Critical Bug Bounties to $30,000 Times of AI Desk · 2026-11-03 · Security [https://timesof.ai/2026/11/openai-security-sprint-cathedral-bug-bounty-critical-30000](https://timesof.ai/2026/11/openai-security-sprint-cathedral-bug-bounty-critical-30000) > Updated Nov. 8: OpenAI said on November 6 that it is partnering with Hacktron, a security firm it found through its bug bounty program, to test high-priority areas focused on how its systems interact with third-party services, and is expanding Hacktron's frontier-model access through Daybreak Red. Earlier, on November 2, OpenAI said Cathedral's researchers will join its next internal security sprint and that it is more than quadrupling the midpoint of its bug bounty ranges on average, with critical flaws in ChatGPT, Codex or the API now paying up to $30,000 and exceptional ones up to $172,000 with bonuses. **Updated November 8, 2026:** OpenAI has added a second outside security team. The new section directly below covers it; the original report follows unchanged. ## November 6: Hacktron joins On **November 6**, OpenAI said it is partnering with **Hacktron** to find vulnerabilities in its systems. OpenAI engineers and Hacktron researchers will choose high-priority areas to test together, with a focus on how OpenAI's systems interact with third-party services. OpenAI is also expanding Hacktron's access to its frontier models through **Daybreak Red**, the programme through which it opened [GPT-6 Cyber to select customers](https://timesof.ai/2026/11/openai-autonomous-pipeline-948-linux-root-exploits-1-2m). OpenAI says it became familiar with Hacktron through its Security Bug Bounty program, and that the firm builds AI agents for code review, penetration testing and red teaming. Hacktron's own post confirms the partnership and says it follows the firm's work in OpenAI's bug bounty program. OpenAI tied the move to the Cathedral sprint and bounty increase covered below, saying it is applying "the same urgency" to its own systems that it applies to cyber defence. ### Limits of the November 8 update - Neither company disclosed the partnership's duration, payment, or the systems in scope beyond third-party connections. - Both posts are the companies' own announcements; we have seen no independent account of the work. OpenAI has picked, for its own in-house attack exercise, the security firm that publicly clashed with Anthropic last month. In posts dated **November 2** and promoted on X early on November 3, the company said it is planning its next internal security sprint and has partnered with **Cathedral**, whose researchers will use OpenAI's models alongside its own teams "to challenge our defenses." In October, the Washington Post reported that Cathedral had told Anthropic its researchers reached sensitive internal systems under a bug bounty; Anthropic said the access was limited and that Cathedral overstated its findings, as we covered in [Cathedral's dispute with Anthropic](https://timesof.ai/2026/10/cathedral-ai-agents-anthropic-internal-systems-bug-bounty). ## The sprint OpenAI says its previous sprint dedicated **25% of its product engineers** to finding and fixing weaknesses, using Codex to investigate findings, reproduce vulnerabilities in isolated environments and prepare patches for review. It says "traditional cyber defenses alone are no longer sufficient," and says it has committed **$1 billion** in subsidised access over six months for frontline defenders of essential services and digital infrastructure. Cathedral's chief executive, Gavin Kliger, said in OpenAI's post that every company "should be thinking about how to put these capabilities to work." OpenAI did not say when the sprint starts, how long it runs or what Cathedral is being paid. ## The bounty In a companion post, OpenAI said it is **more than quadrupling the midpoint** of its reward ranges for medium, high and critical findings, on average. A critical vulnerability in a core product such as ChatGPT, Codex or the API Platform will now earn up to **$30,000**. Exceptional critical findings remain eligible for up to $100,000, and now up to **$172,000** with bonuses. The bonuses are new: a multiplier for high-quality reports with a reliable proof of concept, a five-tier loyalty programme, and campaign multipliers for newly launched features. In one of OpenAI's illustrative examples, a one-click ChatGPT account takeover that historically earned $6,500 would now pay $51,577 once all three multipliers apply. Unpaid reports already submitted get the new ranges, and OpenAI says it will pay the difference on bounties awarded in the 30 days before the announcement. ## Limits - The payout examples are OpenAI's own and described as illustrative; actual awards depend on its triage. - OpenAI has not published results from its last sprint beyond the share of engineers involved, so we cannot judge how effective the approach was. - Cathedral's claims about Anthropic remain disputed by Anthropic; nothing in OpenAI's posts addresses them. ## Sources - [OpenAI: Preparing our next security sprint to harden OpenAI (November 2, 2026)](https://openai.com/index/preparing-our-next-security-sprint-to-harden-openai) - [OpenAI: Rewarding defenders with bigger bug bounties (November 2, 2026)](https://openai.com/index/rewarding-defenders-with-bigger-bug-bounties/) - [OpenAI on X (November 3, 2026, 02:29 UTC)](https://x.com/OpenAI/status/2117444048227123277) - [TechRadar: OpenAI is raising its bug bounty rewards (November 3, 2026)](https://www.techradar.com/pro/security/traditional-cyber-defenses-alone-are-no-longer-sufficient-openai-is-raising-its-bug-bounty-rewards-for-security-researchers-as-ai-attack-worries-grow) - [OpenAI: Partnering with Hacktron to find vulnerabilities in OpenAI's systems (November 6, 2026)](https://openai.com/index/partnering-with-hacktron/) - [Hacktron: Partnering with OpenAI (November 6, 2026)](https://www.hacktron.ai/blog/openai-partnership) - [OpenAI: Introducing GPT-6 Cyber (November 5, 2026)](https://openai.com/index/introducing-gpt-6-cyber)