A single critical flaw in OpenAI’s systems is now worth as much as $172,000 to the researcher who reports it, bonus included. The company said rewards for the most serious findings rose more than fourfold, the plainest number in a package of measures announced on November 3 alongside a partnership with a security firm and a restatement of its pledge to put $1 billion behind the people defending networks.
OpenAI said it will work with Cathedral Systems to find vulnerabilities, verify that fixes hold and harden defenses around the systems the two organizations test. The two organizations will also run a joint exercise: Cathedral’s researchers will join OpenAI’s own teams in the company’s next internal security sprint, using the models to attack the defenses OpenAI has already built.
The framing in the announcement was blunt. OpenAI said the ability of AI systems to find weaknesses is improving, and that defenders need to put that ability to work before attackers do. That sentence does two jobs at once. It describes a technical trend the company has a commercial interest in, and it argues that the same models which make attacks cheaper make defense cheaper too, provided the defenders can get access.
Access is the expensive part. OpenAI restated a commitment to provide $1 billion in subsidies over six months so that frontline security staff, the people running detection and incident response inside hospitals, utilities and small agencies, can use its technology rather than read about it. The money is described as a subsidy rather than a grant, which suggests it will flow through discounts and credits on the company’s products instead of cash.
Bug bounty programs have become the standard way for large technology firms to buy a second opinion on their own code. A researcher who finds a way in reports it privately, the company pays for the finding and fixes the flaw, and the payment is calibrated to the severity of what was found. Raising the top award by more than fourfold changes the calculation for the small number of people worldwide who can find the hardest bugs, and it changes where they spend their month.
The economics of that market are unusual. The supply of skilled researchers is fixed in the short run and the demand comes from every large technology company, security vendor and government at once. Bounties that sit below what a broker will pay for a working exploit do not attract serious attention, and a company that raises its ceiling is competing directly with the market for zero-day flaws rather than with its peers’ published payout tables.
The security partnership is harder to price. Security firms of that kind typically bring a bench of researchers, a set of tools built around a specific model family, and the willingness to be named in a customer’s incident report. OpenAI did not disclose the terms, and did not say whether Cathedral receives model access, a fee or both.
For OpenAI, the strategic logic runs through distribution as much as defense. The company sells model access to developers and enterprises, and security teams have been slow buyers. They run isolated environments, they distrust tools that send data outside their network, and they answer to regulators who ask where the data went. A partnership with an established security firm, a subsidy that lowers the price of entry and a bounty that pays the research community are three ways of getting a model into that workflow without asking a bank’s security chief to make an exception.
The counterargument, made by security researchers for as long as AI models have been able to read code, is that the same capability cuts both ways. A model that can find a memory-safety bug in a decade-old codebase can find one for whoever asks. Model providers have responded with usage policies and classifiers, which are imperfect by construction, and with the argument that capability will spread regardless, so the defenders should be first to hold it.
There is a further complication. Models that read code well enough to find vulnerabilities also write plausible code, and the volume of machine-written software now entering production has increased the surface that defenders must cover. Patch verification, the part of the Cathedral arrangement that will get the least attention, is where the practical value sits. A finding that cannot be confirmed as fixed is a ticket that never closes, and security teams have learned to distrust scanners that produce more alerts than they can resolve.
The timetable is short. OpenAI said the next internal security sprint is being prepared, and Cathedral’s researchers will take part in it with their own team’s defenses as the target. Internal exercises of that kind are usually where a company discovers that its own controls were designed for a threat model that has moved.
For the $172,000, the company gets something it cannot buy directly: evidence that the ceiling on its bounty program is high enough to be taken seriously by the researchers who would otherwise sell what they find. For the defenders receiving subsidies, the offer is a tool at a discount, with the strings that come with any discount from a vendor that also sells the model. Both are bets that the gap between the two sides of this contest closes faster than the attackers can exploit it.
