OpenAI pays up to $172,000 for bugs as its data center rebrand draws fire

Two announcements, one company, one afternoon. On 3 November OpenAI quadrupled its bug bounty payouts, according to The Decoder. Critical vulnerabilities in core products are now worth up to $30,000 to outside researchers. Exceptional findings can reach $100,000. Quality, loyalty and campaign bonuses take the total to roughly $172,000.

The same day, The Verge reported that OpenAI has begun using the phrase "compute campuses" for its data centers. The rebrand is the more politically loaded of the two. The Verge counted the term "data center" just twice in OpenAI's roughly 900 word announcement of its Grid Protectors Program. "Compute campus" appeared more often. That program starts with a site in Effingham County, Georgia. It promises that OpenAI will "pay the costs we create" and "help communities keep the lights on". The article also quotes Holly Elmore, founder and executive director of PauseAI US. She said the company is responding to the unpopularity of data centers rather than to their footprint.

Money on the table, and where it comes from

The bounty change is easier to price. The Decoder puts the new top payout in the same range as Google's general vulnerability rewards program. It is still below what Apple or Microsoft pay for operating-system exploits. OpenAI is also adding a five-tier loyalty program and time-limited campaigns tied to product launches. It will pay the difference between old and new rates to anyone who reported a flaw in the last 30 days. A security sprint will follow, with the security firm Cathedral working alongside OpenAI's own engineers. During the last one, 25 percent of OpenAI's product engineers worked on finding vulnerabilities, the company said.

There is a commercial logic underneath the generosity. OpenAI is asking outsiders to find flaws in the same products it sells. It pays them partly in bonuses tied to loyalty and to new releases. That is a monetisation model in reverse: the company spends on security to protect subscription revenue it cannot afford to interrupt. The Decoder's report does not put a total budget on the program. OpenAI has not published one either.

"OpenAI is clearly responding to the unpopularity of data centers," said Holly Elmore, founder and executive director of PauseAI US, in comments to The Verge.

The rebrand did not start this week. Tom's Hardware reported on 2 November, citing Axios, that OpenAI was preparing a public relations push. It included renaming its data centers "AI Compute Campuses". The push came ahead of the 3 November midterm elections and with an eye on the 2028 presidential race. Chris Lehane, OpenAI's chief global affairs officer, told Axios that the midterms would be "a bit of a movie trailer for what you're going to see in 2028". The same report says the terminology shift had been under discussion since August. The Verge's piece adds that OpenAI's own website had no earlier uses of the phrase.

Not every open source story here is about OpenAI, and not every one is about money. The Register reported on 3 November that cloud architect Andrija Panić had built OpenVDDK. It is an open source replacement for VMware's Virtual Disk Development Kit. He built it after Broadcom restricted public downloads of the tool in August. Panić told The Register the project was written from scratch using public documentation and black-box testing. It contains no VMware code, and it cannot write disks, only read them. He also said he had received reports of production use, including a German cloud provider and a US company migrating to Apache CloudStack. He stressed those reports are "not independently audited customer endorsements".

That is the open source monetisation question in its purest form: a free tool that undercuts a paid vendor's lock-in, with no business model attached.

Defence contracts and mathematics papers

OpenAI's other 3 November move points the other way. The company hired Dan Driscoll, the former Secretary of the Army, as "Senior Counselor for National Security Modernization", according to The Decoder, which cites The Wall Street Journal. CNBC also reported the hire. Driscoll oversaw nearly one million soldiers and more than 265,000 civilian employees in his previous role. He drove AI modernisation through an initiative called Project ARIA. The Decoder notes that OpenAI won a Pentagon contract for classified networks in February 2026, after rival Anthropic was classified as a "supply chain risk". Government work is the oldest monetisation route in the defence business, and OpenAI is now staffing for it.

Then there is the research. German tech outlet t3n reported on 3 November that OpenAI published more than 700 manuscripts in October. They covered over 370 problem areas and were produced with an unreleased AI model at an average of three hours per manuscript. The response from mathematicians has been hostile. The association for human mathematics, as t3n describes it, called the simultaneous publication of more than 700 files a demonstration of power rather than proof of scientific competence. The German Mathematicians' Association argued that AI works towards results while mathematical research is about the method. t3n quotes Demian Nahuel Goos saying that a proof on its own delivers very little insight.

None of this generates revenue directly, but it shapes the reputation that the bounty program and the defence hiring are trying to buy. The common thread is that OpenAI is spending freely on security, lobbying and prestige while its competitors try to sell software. The Verge's report suggests the company believes a name change can defuse political opposition. The Decoder's bounty story suggests it believes cash can buy goodwill from researchers. Neither claim has been tested yet. The Georgia site has not opened, and the payout totals are ceilings, not averages.