AI Weekly Malaysia

OpenAI announced a second internal security sprint, again pairing its own teams with outside researchers — this time including security firm Cathedral — to use OpenAI models to probe and harden its systems. It is more than quadrupling bug bounty payouts for critical findings, and says its previous sprint dedicated 25% of product engineers to finding and fixing weaknesses, using Codex to investigate findings, reproduce vulnerabilities in isolated environments, and prepare patches. OpenAI also committed $1 billion in subsidized model access over six months for defenders protecting essential services and digital infrastructure, and is publishing its architecture and lessons from the last sprint.

Why: The concrete, checkable items for builders are the bounty economics and the published sprint architecture: if critical-finding rewards have more than quadrupled, security researchers and small security tooling shops should re-evaluate whether OpenAI's program is now worth targeting over other vendors, and the released write-up on how Codex was used to reproduce and patch vulnerabilities is a reusable template for running the same loop in your own codebase. The $1B subsidised access is aimed at defenders of essential services and digital infrastructure, so most SaaS teams should treat it as a possible eligibility check rather than a given.

OpenAI raised bug bounty rewards, more than quadrupling the midpoint of reward ranges for medium, high, and critical findings. A critical vulnerability in ChatGPT, Codex, or the API Platform now pays up to $30,000, with exceptional critical findings up to $100,000 and up to $172,000 with bonuses. OpenAI also added quality-report multipliers, a 5-tier loyalty bonus, and priority campaign pools; one example shows a medium ChatGPT file-upload permission bug rising from $750 to $2,415 after quality and Bronze loyalty multipliers.

Why: If you have a reproducible vulnerability in ChatGPT, Codex, or the OpenAI API Platform, the payout table has changed enough to check before reporting: a medium finding can now clear $2,400 in the example, and critical findings can reach $172,000 with bonuses. If you are just building on OpenAI, there is no product, pricing, or compliance change here, so do not change your architecture because of this announcement.