OpenAI is bringing external security researchers into its next internal security sprint, giving them access to its models to find vulnerabilities in its defenses.
The company is working with Cathedral Systems, whose researchers will work with OpenAI’s teams to test its systems and help strengthen protections on its platforms.
The planned exercise builds on a previous sprint involving 25 percent of OpenAI’s product engineers.
In parallel with the partnership, the company is increasing its security bug bounties, with exceptional finds being rewarded with up to $172,000 including bonuses.
OpenAI has not specified when the next sprint will begin. The effort was portrayed as part of a broader push to continually use AI to identify and fix vulnerabilities before attackers can exploit them.
External researchers take part in defense tests
Cathedral researchers will use OpenAI’s models alongside the company’s own security teams to challenge its defenses. OpenAI said the partnership will bring different expertise and approaches to identifying vulnerabilities.
According to Gavin Kliger, CEO and co-founder of Cathedral, the collaboration will also include testing bug fixes.
“OpenAI leads by example by collaborating with third-party security firms and using its own models to continually test and strengthen its defenses. Every company should think about how they can leverage these capabilities,” said Kliger.
“We are excited to work with the teams at OpenAI and combine their models and security expertise with our research to find vulnerabilities, test fixes and strengthen this approach to continuous defense,” he added.
The announcement describes a planned collaboration rather than completed results. It does not identify specific vulnerabilities discovered as part of the new partnership, nor does it explain details that system researchers will investigate.
Higher rewards for critical insights
OpenAI is also quadrupling rewards for critical results under its Security Bug Bounty program. Exceptional finds have a maximum payout of $172,000, including bonuses.
The company said it wants researchers to challenge its assumptions and strengthen both its systems and the methods used to defend them.
During the previous internal sprint, engineers used Codex to investigate findings, reproduce vulnerabilities in isolated environments, and prepare patches for review. OpenAI has dedicated a quarter of its product engineers to this task.
The next sprint will build on this work by connecting new researchers and security partners with internal teams.
OpenAI said traditional cyber defenses alone are no longer enough, pointing to recent incidents in the industry as evidence of how quickly threats can emerge. The stated goal is to build continuous defense loops that find and fix vulnerabilities before attackers do.
Beyond its internal systems, the company makes its most powerful models available to Daybreak customers. It has provided $1 billion in subsidized access over six months for frontline defenders protecting essential services and digital infrastructure.
OpenAI also shares its architecture and lessons learned from its previous sprint, as well as a blueprint for empowering cyber defenders in industry and government.
The company said it will continue to develop its models, apply them to its own defenses and expand access to trusted defenders as AI gets better at finding vulnerabilities.
