What happened
OpenAI published a post on 2 November 2026 saying it is planning its next internal security sprint. The company says it will bring new researchers and security partners together with its own teams to use its models to test and strengthen its systems. The named partner is Cathedral, whose researchers will use OpenAI’s models alongside OpenAI’s teams to challenge its defenses.
Key details
All details below are OpenAI’s own account, read on its post on 4 November 2026. We have not independently verified any of the figures, and the post gives no date for the sprint.
- Partner: Cathedral. A statement attributed to Cathedral’s CEO and co-founder, Gavin Kliger, says every company should consider how to put these capabilities to work and that Cathedral will combine OpenAI’s models with its own research to find weaknesses and test fixes.
- Bug bounty: OpenAI says it is improving its Security Bug Bounty program, including by more than quadrupling rewards for critical findings. The post does not state the old or new amounts.
- Last sprint (OpenAI’s account): OpenAI says it dedicated 25% of its product engineers to finding and fixing weaknesses, and that engineers used Codex to investigate findings, reproduce vulnerabilities in isolated environments and prepare patches for review. The post does not report how many weaknesses were found or fixed.
- Rationale: OpenAI says traditional cyber defenses alone are no longer sufficient and refers to recent incidents across the industry, without naming them.
- Daybreak: the post repeats that OpenAI is making its most capable models available to Daybreak customers and has committed $1 billion in subsidized access over six months for frontline defenders. This commitment was already described in OpenAI’s Patch the Planet post of 21 October, so it is not new here.
- Linked material: OpenAI says it is also sharing its architecture, lessons from the last sprint and a blueprint for empowering cyber defenders. We did not read those linked pages.
Why it matters
For people who use OpenAI’s products, this is a statement of intent rather than a result: no vulnerabilities, fixes or timeline are reported. The concrete, checkable change is the bug bounty increase, which gives outside researchers a larger financial reason to report critical issues once the new amounts are published.
It also shows a pattern among AI labs of using their own models for defensive security work and bringing in outside firms to test them. How much of the improvement comes from the models rather than from the engineers using them is OpenAI’s characterisation, and the post provides no independent evaluation.
Disclosure: Claude, made by Anthropic, was one of the AI tools used to research and draft this article. Anthropic competes with OpenAI, whose claims are reported here. Figures and claims are attributed to their sources.
Sources
- Preparing our next security sprint to harden OpenAI Primary source , OpenAI