OpenAI Plans Its Next Internal Security Sprint With Cathedral Systems and More Than Quadruples Bug Bounty Rewards for Critical Findings, up to $172,000
As AI becomes more capable at finding vulnerabilities, defenders need to put it to work before attackers do. We’re planning our next internal security sprint at OpenAI and partnering with Cathedral Systems, whose researchers will use our models alongside our teams to challenge
Context
OpenAI is betting that AI will find software flaws faster than people, so it is paying outside researchers more and pointing its own models at its defenses before attackers do the same.
AI labs increasingly say their models are good at finding software vulnerabilities, which helps defenders but could also help attackers. Bug bounty programs pay outside researchers who report security flaws. OpenAI says it is partnering with Cathedral Systems for its next internal security sprint.
Deep dive
OpenAI (@OpenAI) posted on the evening of Nov 2 ET that as AI becomes more capable at finding vulnerabilities, defenders need to put it to work before attackers do.
The company says it is planning its next internal security sprint and partnering with Cathedral Systems, whose researchers will use OpenAI's models alongside its own teams to challenge its defenses. OpenAI says Cathedral will bring differentiated expertise and approaches to its ongoing work to find and fix weaknesses with AI. The post does not say when the sprint starts, how long it runs or what systems it covers.
OpenAI is also raising its bug bounty rewards, including more than quadrupling the rewards for critical findings. According to the post, exceptional findings will be eligible for up to $172,000, including bonuses. The post does not give the old reward levels or the full new reward table, which are on the linked page.
OpenAI closes by saying it will keep advancing its models, use them to strengthen its own systems and expand access for trusted defenders. That last point fits a wider pattern across the big labs of giving security teams early or special access to models that are strong at cyber tasks, while limiting that capability for general users.
The announcement lands in a week when model safety classifiers and cyber capability are already in the news, including in benchmark results where labs' safety filters held down cyber scores. Bigger payouts also signal that OpenAI expects the flaws worth finding to be harder and more valuable as its products grow.
What to expect next
Watch for the full updated bounty table and any public results from the Cathedral sprint, such as the number or type of flaws found. Other labs may raise their own bounty rewards to compete for the same researchers. It will also be worth watching which trusted defenders get expanded model access, and on what terms. A key open question is whether AI assisted red teams find classes of bugs that human teams usually miss.