OpenAI Launches New Security Sprint to Hunt Vulnerabilities and Strengthen Defenses

What happened?

OpenAI is preparing a new internal security sprint that will bring outside researchers together with its own teams to find vulnerabilities, test fixes, and strengthen its platforms using AI. Announced on November 2, the effort includes a partnership with Cathedral Systems and higher bug bounty rewards to encourage independent researchers to report serious security flaws. The security sprint announcement describes a broader push toward continuous defense, where finding weaknesses and checking repairs becomes ongoing work rather than a one-time assessment.

Key details

• OpenAI announced a new internal security sprint on November 2 that brings outside researchers together with its own teams to find vulnerabilities and test fixes.
• The sprint includes a partnership with Cathedral Systems to combine external research with OpenAI models and security expertise.
• OpenAI has increased bug bounty rewards, with critical vulnerabilities in core products now earning up to $30,000 and exceptional findings eligible for up to about $172,000.
• The Defense Factory architecture uses agents to map systems, investigate flaws, confirm reproducibility, identify responsible teams, and prepare tested fixes in isolated environments.
• Lessons from earlier testing showed duplicate findings slowed review, severity ratings needed clearer instructions, and missing dependencies made some tests difficult to run.
• Follow-up checks revealed that a merged patch did not always mean the fix had reached every deployed system, so human review and independent checks remain part of the workflow.
• The security sprint builds on a previous effort where 25% of product engineers were assigned to security work and used Codex to investigate reports and prepare patches.

Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.