OpenAI has rolled out a fresh internal “security sprint” designed to collaborate with outside researchers and its own engineering teams to unearth vulnerabilities, test remedies, and boost overall platform defenses through AI-driven review. The initiative, unveiled November 2, includes a new partnership with Cathedral Systems and substantially higher rewards for bug bounty submissions, especially in core products like ChatGPT, Codex, and the API platform.
The sprint marks a shift toward “continuous defense” — instead of audits being episodic, they’ll become ongoing. By teaming up with Cathedral Systems, OpenAI is bringing in external experts to work with internal models and staff to probe defenses and test fixes. The timeline, list of priority targets, and preliminary findings have not yet been disclosed.
Building on Early Trials
The move builds on earlier efforts in which OpenAI reassigned 25% of its product engineers to focus on security. These engineers relied on its Codex model to analyze reports, replicate bugs in isolated test setups, and develop patches for further review. The company’s Defense Factory architecture underpins this process: agents map systems, check potential flaws, verify reproducibility, pinpoint responsible teams, and build fixes — all outside live production systems.
Initial testing surfaced challenges. Duplicate findings slowed down the review process. Severity rating guidance needed more clarity. Some testing was hampered by missing dependencies, and patches that were merged didn’t always reach every deployed system. These gaps mean human appraisal and independent checks remain crucial components of OpenAI’s security workflow.
Elevated Rewards for Bug Hunters
To fuel greater external participation, OpenAI has raised its bug bounty awards. Critical vulnerabilities in major platforms can now fetch up to $30,000. Exceptionally severe or well-documented findings may earn $100,000 or more, with bonuses pushing total payouts to about $172,000 depending on the quality of reports, researcher history, and focus campaign status.
This bounty adjustment is part of a broader program beyond just financial rewards. It ties into OpenAI’s “Daybreak for Frontline Defenders,” a six-month initiative backed by $1 billion in commitments toward subsidized access, support, and partnerships targeted at critical services and resource-limited organizations. That program shares the sprint’s goal: ensuring confirmed weaknesses are converted into tested fixes, overseen by responsible guardrails for decisions with major consequences.
What this means: OpenAI is doubling down on proactive security, not just defensive posture. Continuous testing, transparency, external oversight, and higher incentives signal that safeguarding its AI offerings isn’t a mere checkbox but a strategic priority. Watch for detailed findings from this sprint, how swiftly patches reach production systems, and whether this approach becomes an industry standard for AI platforms going forward.
