Image: OpenAI
OpenAI says it is getting ready for another big push to find and fix security holes in its own systems, and it is bringing in outside help to do it. The company shared the plan on November 2 and announced it on X.
As AI becomes more capable at finding vulnerabilities, defenders need to put it to work before attackers do.
— OpenAI (@OpenAI) November 2, 2026
We’re planning our next internal security sprint at OpenAI and partnering with Cathedral Systems, whose researchers will use our models alongside our teams to challenge our defenses. They’ll bring differentiated expertise and approaches to our ongoing work to find and fix weaknesses with AI.
We’re also raising bug bounty rewards, including more than quadrupling rewards for critical findings. Exceptional findings will be eligible for up to $172,000, including bonuses.
We’ll keep advancing our models, using them to strengthen our own systems, and expanding access for trusted defenders.
openai.com/index/preparing-our-next-security-sprint-to-harden-openai/
OpenAI calls this push a security sprint. In simple terms, a sprint is a short, focused stretch of time when a team drops other work to concentrate on one goal. Here the goal is to find weak spots in OpenAI's software before criminals do. Security experts call these weak spots vulnerabilities.
For the next sprint, OpenAI is working with a security company called Cathedral Systems. OpenAI says Cathedral's researchers will use OpenAI's AI models alongside its own teams to test its defenses, much like a friendly break in that shows where the locks are weak.
Gavin Kliger, the CEO and co founder of Cathedral, said in OpenAI's post that OpenAI is setting an important example by working with outside security firms and using its own models to keep testing its defenses. He added that every company should be thinking about how to put these tools to work.
OpenAI is also raising the payouts in its bug bounty program. A bug bounty is a reward a company pays to outside researchers who find and report security problems, so the problems can be fixed instead of abused. OpenAI says rewards for the most serious findings will more than quadruple, and exceptional reports can earn up to $172,000 including bonuses. Coinlive also reported the new top reward.
According to OpenAI, its last sprint put 25% of its product engineers on the job. They used Codex, the company's AI coding tool, to look into reported problems, recreate them safely in sealed off test setups and prepare fixes for review.
OpenAI describes that earlier effort in more detail on a separate page about what it calls the Defense Factory. The company says the sprint involved more than 250 people across more than 100 areas of its services, and grew into a system where AI agents keep looking for problems, check whether they are real and help fix them around the clock.
Image: OpenAI
OpenAI's reasoning is that AI is getting good at finding software flaws, and attackers can use it too. The company says older security methods alone are no longer enough, and that defenders need to use the most capable AI first while they still have a head start. OpenAI calls that head start the defender's window.
OpenAI says it is offering its strongest models to customers of Daybreak, its security product, and has committed $1 billion in discounted access over six months for teams that protect essential services and digital infrastructure.
OpenAI has not said when the next sprint will begin or how long it will last at the time of this writing.
Comments