OpenAI raises critical bug bounties more than fourfold ahead of new security sprint

OpenAI is bringing outside researchers into its next internal security sprint, using its own models to help challenge its defenses. In a November 2 announcement, the company named Cathedral as a partner and said it would more than quadruple rewards for critical findings in its Security Bug Bounty program.

Outside researchers, OpenAI’s tools

Cathedral’s researchers will work alongside OpenAI’s teams and use OpenAI models to look for weaknesses. The company is seeking outside expertise and different approaches to testing its platforms, rather than relying only on its own staff to challenge the defenses they maintain.

The sprint is still being planned. OpenAI’s announcement does not specify when testing will begin or which systems Cathedral will examine.

From a suspected flaw to a reviewed patch

The previous sprint shows the scale of the engineering commitment behind this approach. OpenAI says it dedicated 25% of its product engineers to finding and fixing weaknesses in its systems, making the exercise a substantial product-engineering effort.

OpenAI’s stated goal is to make finding and fixing weaknesses a continuous process. It argues that traditional cyber defenses alone are no longer sufficient, and that organizations need advanced AI capabilities to harden their systems before attackers exploit weaknesses.

Larger rewards for critical findings

The bounty increase targets critical findings. OpenAI says it wants researchers to challenge not only its systems, but also the assumptions and methods behind its defenses. The larger rewards accompany the internal sprint as another way to encourage that scrutiny.

The company also says it is sharing architecture and lessons from its previous sprint, alongside a blueprint for cyber defenders in industry and government. That puts its defensive methods, as well as its systems, forward for others to examine.