VULNpocalypse
InformationalEcosystem changeMonitoring

OpenAI partners with Cathedral Systems, raises bug bounty, India Today reports

India Today reports OpenAI raised critical bug bounties to up to $172,000; researchers should confirm current terms with OpenAI before submitting.

Published
Exploitation
No, the source describes a security testing program and bounty change, not a vulnerability or exploitation

What happened

According to India Today, OpenAI says its next internal “security sprint” will be run with Cathedral Systems, a cybersecurity startup. This advisory does not report a vulnerability, breach or patch.

  • Partner: India Today reports that Cathedral Systems was founded by former DOGE staffers. It also reports that the firm’s AI agents found security gaps in Anthropic’s third-party business systems in under 12 hours. The source does not include any confirmation of that claim from Anthropic.
  • How the sprint works: India Today says OpenAI described a setup in a post on X where external researchers use OpenAI’s own models alongside internal teams to test its defenses (India Today).
  • Bounty change: India Today reports that OpenAI raised its bug bounty for critical findings. Exceptional discoveries can now earn up to $172,000, including bonuses. The outlet says this is more than four times the previous reward for critical findings.
  • Previous sprint: According to India Today, OpenAI’s last sprint used 25 per cent of its product engineers to find and fix security weaknesses. In that sprint, engineers used Codex to look into findings, reproduce vulnerabilities in safe test environments and create patches. India Today says OpenAI describes this as an ongoing process.

Not confirmed:

  • the sprint’s start and end dates
  • which OpenAI products or systems are in scope
  • the exact previous bounty amount
  • the eligibility rules

This advisory is based on one source outlet. The original OpenAI post on X was not provided as a source.

Am I affected?

The source does not describe any product vulnerability, CVE or required update. This is mainly relevant if you take part in, or plan to take part in, OpenAI’s bug bounty program as a security researcher.

What to do now

  1. If you submit findings to OpenAI, check the bounty amounts, scope and rules directly with OpenAI before you rely on the figures reported by India Today.
  2. If you build on OpenAI products, the source does not state any action for you. Watch OpenAI’s official channels for any security advisories that come out of the sprint.

Sources