OpenAI taps Cathedral for security sprint, more than quadruples bug bounty

OpenAI's decision to bring in Cathedral follows a previous internal sprint in which the company dedicated 25% of its product engineers to finding and fixing weaknesses. During that effort, engineers used Codex to investigate findings, reproduce vulnerabilities in isolated environments and prepare patches for review. OpenAI says that sprint showed what an AI-assisted approach can deliver, and the new sprint builds on it.

The company frames the escalation as a response to a changing threat landscape. OpenAI states that traditional cyber defenses alone are no longer sufficient and points to recent incidents across the industry as evidence of how quickly threats can emerge. In that context, the more than quadrupling of critical-finding rewards and the involvement of outside researchers are presented as ways to challenge internal assumptions rather than rely solely on in-house review.

OpenAI is also extending the same defensive capabilities beyond its own walls. It says it is making its most capable models available to Daybreak customers and has committed $1 billion in subsidized access over six months for frontline defenders protecting essential services and digital infrastructure. Alongside that, OpenAI is sharing its architecture and lessons from the last sprint, plus a blueprint for empowering cyber defenders across industry and government.