OpenAI Launches New Security Sprint to Hunt Vulnerabilities and Strengthen Defenses

OpenAI is preparing a new internal security sprint that will bring outside researchers together with its own teams to find vulnerabilities, test fixes, and strengthen its platforms using AI.

Announced on November 2, the effort includes a partnership with Cathedral Systems and higher bug bounty rewards to encourage independent researchers to report serious security flaws.

The security sprint announcement describes a broader push toward continuous defense, where finding weaknesses and checking repairs becomes ongoing work rather than a one-time assessment.

Cathedral researchers will use OpenAI models alongside company staff to challenge existing protections and bring fresh approaches to testing its systems.

Cathedral Partnership Expands Security Testing

Gavin Kliger, CEO and co-founder of Cathedral Systems, said the collaboration would combine his team’s research with OpenAI’s models and security expertise to find weaknesses, test fixes, and improve continuous defense. The announcement outlines the planned collaboration but does not provide a start date, target list, or vulnerability findings from the upcoming sprint.

The effort builds on an earlier sprint in which OpenAI assigned 25% of its product engineers to security work. Engineers used Codex to investigate reports, reproduce vulnerabilities in isolated environments, and prepare patches for review. This approach ties AI-assisted vulnerability discovery to practical checks before proposed changes reach production systems.

OpenAI’s published Defense Factory architecture explains how that process works. Agents map systems, investigate possible flaws, confirm whether issues can be reproduced, identify responsible teams, and prepare tested fixes. Isolated environments provide the code, services, and settings needed to test a suspected vulnerability without running experiments directly against live systems.

The company also describes lessons from early testing. Duplicate findings slowed review, severity ratings needed clearer instructions, and missing dependencies made some tests difficult to run. OpenAI says follow-up checks exposed another important gap: a merged patch did not always mean the fix had reached every deployed system. Human review and independent checks therefore remain part of the workflow.

This builds on the capabilities covered in Cybersecurity News’ report on OpenAI Codex Security, which examined the agent’s role in discovering, validating, and fixing software vulnerabilities. The new sprint applies that model-assisted approach to OpenAI’s own defenses with added outside research support.

Higher Bug Bounties

Alongside the sprint, OpenAI has increased Security Bug Bounty rewards. Critical vulnerabilities in core products, including ChatGPT, Codex, and the API Platform, can now earn up to $30,000.

Exceptional critical findings remain eligible for a $100,000 base award, with bonuses bringing potential payouts to about $172,000. Report quality, researcher loyalty, and priority campaigns affect the final amount.

These changes extend the program previously covered in OpenAI’s $100,000 bug bounty expansion. Researchers should distinguish normal critical rewards from exceptional awards rather than treat the highest advertised payout as standard.

OpenAI is also connecting this work to Daybreak for Frontline Defenders, its $1 billion commitment to subsidized access, training, support, and partnerships over six months. The initiative targets essential services and organizations with limited security resources.

Its stated goal mirrors the internal sprint: help defenders turn confirmed weaknesses into tested fixes, while keeping people responsible for consequential decisions.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post OpenAI Launches New Security Sprint to Hunt Vulnerabilities and Strengthen Defenses appeared first on Cyber Security News.