OpenAI plans new security sprint with Cathedral and raises bug bounty payouts

OpenAI says it is planning its next internal security sprint, bringing together its own teams, new researchers and outside security partners to use its AI models to test and strengthen its systems. For this round, it is partnering with Cathedral, whose researchers will use OpenAI's models alongside OpenAI's own teams to try to break through its defenses.

Gavin Kliger, CEO and co-founder of Cathedral, said OpenAI is setting an example by working with outside security firms and using its own models to continuously test its defenses, and argued every company should think about putting these capabilities to work. OpenAI is also raising its bug bounty rewards, more than quadrupling payouts for critical findings, with exceptional findings now eligible for up to $172,000 including bonuses.

OpenAI said that during its last sprint, it dedicated a quarter of its product engineers to finding and fixing weaknesses, using its Codex tool to investigate findings, reproduce vulnerabilities in isolated environments and prepare patches for review. The company argues traditional cyber defenses alone are no longer enough given how fast new threats emerge, and says it already uses its most capable models for its own defense while making them available to customers of its Daybreak program. It has committed $1 billion in subsidized access over six months for frontline defenders protecting essential services and digital infrastructure It is also sharing the architecture and lessons from that sprint, along with its blueprint for empowering cyber defenders.

Why it matters

It signals that frontier AI labs now treat AI-assisted red teaming and much larger bug bounties as standard practice for their own security.

Source: OpenAI