OpenAI partners with Cathedral to test its security defenses and revamps its Security Bug Bounty program, including quadrupling rewards for critical findings

Critical bug discovery payments can now be four times higher for security researchers.

OpenAI has announced an overhaul of its Security Bug Bounty program, significantly increasing rewards for independent security researchers. The company is introducing new bonus categories for report quality, researcher loyalty, and priority campaigns. While specific reward amounts and effective dates were not disclosed, this move aims to incentivize more detailed and high-priority vulnerability reports. This initiative aligns with a broader trend in the tech industry, where major players like Google and Microsoft are also re-evaluating and enhancing their bug bounty programs. OpenAI's announcement follows reports of Microsoft bug hunters potentially earning record payouts and a general increase in critical bugs being found across various platforms. The company is also partnering with Cathedral Systems to test its security defenses, further underscoring its commitment to bolstering its cybersecurity measures.

OpenAI's enhanced bug bounty program signals a maturing landscape for AI security, where the cost of vulnerabilities is escalating. By quadrupling rewards for critical findings, OpenAI is not just attracting more researchers but also implicitly acknowledging the exponential increase in potential damage from exploitable AI flaws. This competitive compensation strategy aims to preemptively identify and fix weaknesses, crucial as AI models become more integrated into critical infrastructure and sensitive data processing. The program's new bonus structures also suggest a desire for more actionable, high-quality reports, moving beyond simple bug identification to comprehensive vulnerability analysis. This may pressure other AI companies to adopt similar incentivization models to maintain their security posture.

The partnership with Cathedral Systems to test defenses, alongside the bug bounty revamp, indicates a proactive and multi-faceted approach to AI security. This collaboration suggests that internal testing alone is insufficient, and external validation from specialized firms is becoming a necessity for frontier AI development. For security researchers, this means a potentially more lucrative and professionalized field, with clearer pathways for engagement and reward. It also implies that the stakes for AI security are rising, not just for the companies developing the technology but for the entire ecosystem that relies on its integrity.