OpenAI plans new security sprint with Cathedral and bigger bug bounty rewards
OpenAI is preparing its next internal security sprint, pairing outside researchers and security partners with its own teams to use its models against its own systems. The company is also more than quadrupling rewards for critical findings in its Security Bug Bounty program.
- OpenAI is planning its next internal security sprint, working with security partner Cathedral.
- The Security Bug Bounty program will pay more than four times as much for critical findings.
- In the last sprint, 25% of OpenAI's product engineers worked on finding and fixing weaknesses, using Codex.
- OpenAI has committed $1 billion in subsidized access over six months for frontline defenders.
- The company is sharing its architecture, lessons and a blueprint for cyber defenders across industry and government.
Cathedral joins the next sprint
According to OpenAI, the new sprint will bring together new researchers and security partners with the company's own teams. The goal is to use OpenAI's models to test and strengthen its systems.
The company named Cathedral as a partner. Cathedral's researchers will use OpenAI's models alongside OpenAI staff to challenge the company's defenses. OpenAI says Cathedral brings "differentiated expertise and approaches to finding weaknesses" and will help protect its platforms.
OpenAI also announced improvements to its Security Bug Bounty program, including more than quadrupling rewards for critical findings. The company says it wants researchers to challenge its assumptions and help strengthen both its systems and the methods it uses to defend them.
What the last sprint involved
OpenAI describes the effort as part of an ongoing push to use AI to continuously find and fix weaknesses. It points to its previous sprint as evidence of what the approach can deliver.
In that sprint, the company dedicated 25% of its product engineers to finding and fixing weaknesses in its systems. Using Codex, engineers investigated findings, reproduced vulnerabilities in isolated environments and prepared patches for review.
OpenAI says it is building on that work because traditional cyber defenses alone are no longer sufficient. It argues that recent incidents across the industry show how quickly threats can emerge, and how important it is to build continuous defensive loops that find and fix weaknesses before attackers do.
Access for defenders and shared lessons
OpenAI says that keeping the defender's window open requires organizations to use frontier cyber capabilities to harden their systems. The company is using its most capable models to strengthen its own defenses and is making them available to Daybreak customers.
It has committed $1 billion in subsidized access over six months for frontline defenders protecting essential services and digital infrastructure.
The company is also sharing its architecture and lessons from the last sprint, along with a blueprint for empowering cyber defenders across industry and government.
What it means for defenders
For security teams, the announcement points to wider access to OpenAI's most capable models through Daybreak, backed by the $1 billion subsidized access commitment aimed at those protecting essential services and digital infrastructure. For independent researchers, the higher critical rewards in the Security Bug Bounty program offer a stronger incentive to report serious flaws.
OpenAI says it will keep advancing its models, use them to strengthen its own systems and expand access for trusted defenders. In its words, keeping the defender's window open "will take action across the industry, and that work needs to start now."
OpenAI: Preparing our next security sprint to harden OpenAI
