OpenAI raises critical bug bounty to $172K ahead of security sprint
The 4x raise lands mid-siege: a trojanized Claude Code extension in Cursor, agentic-AI hits on vendors, and Mistral's 1T open-weight coder is live.
Copy markdown
Bigger bounties, a sprint to match
OpenAI more than quadrupled its bug-bounty midpoints: critical bugs in ChatGPT, Codex, or the API now pay up to $30K, and as much as $172K with bonuses. It is also lining up a security sprint with startup Cathedral, which will turn OpenAI's own models loose on OpenAI's defenses. If you hunt vulns, the payout math just changed.
A Claude Code extension went rogue in Cursor
Builds 2.1.312 and 2.1.313 of the Claude Code extension, served only through Cursor's marketplace for ~11 hours on Oct 29, shipped a backdoor that plants an SSH key (svc-telemetry) and opens a reverse tunnel. Up to 5,000 users pulled it. Fix today: update to 2.1.314+, grep authorized_keys for svc-telemetry, and rotate reachable creds. Anthropic's own channels and Open VSX stayed clean.
Autonomous agents are breaching your vendors
WorkOS disclosed that attackers wielding ARTEX — an autonomous AI-agent attack framework — reached an internal sales tool on Oct 30 and took CRM and support data; its auth product wasn't touched. Wiz ties ARTEX to Storm-0940, which has also hit ConnectWise and 2,250+ Microsoft 365 tenants. Agents that 'hunt login doors and stay 30 hours' are now a live threat to any SaaS you lean on.
Mistral Large 4 weights are downloadable
Mistral's 1T-parameter coder (52B active per task) is now open-weight on Hugging Face. A quantized build runs on four Nvidia B200/B300 GPUs and scores 41% on Terminal-Bench 4.0 — level with GLM-5.3 while burning ~47% fewer tokens per task. If you want a frontier-class coding model you host yourself, grab this; laptop-sized distills are promised next.