OpenAI Announces New Security Sprint and Expanded Bug Bounty Program

New Security Sprint and External Collaboration

OpenAI is initiating a new internal security sprint that utilizes its own models to test and harden its infrastructure. A central component of this initiative is a partnership with Cathedral, whose researchers will work alongside OpenAI teams to identify potential weaknesses and challenge existing defensive architectures. This collaborative approach aims to integrate differentiated security expertise into the model-testing process.

Expansion of the Security Bug Bounty Program

To further incentivize the discovery of vulnerabilities, OpenAI is quadrupling the rewards offered through its Security Bug Bounty program for critical findings. This update is designed to encourage external researchers to rigorously test the company's systems and challenge underlying security assumptions. The program remains a key pillar in OpenAI's strategy to maintain a robust defensive posture as it progresses toward AGI.

Scaling AI-Driven Defensive Loops

OpenAI is shifting away from reliance on traditional cyber defenses alone, favoring a model of continuous defensive loops that identify and remediate threats in real-time. During a previous internal sprint, 25% of the company's product engineers utilized Codex to automate the investigation of findings, reproduce vulnerabilities in isolated environments, and prepare patches. This methodology is being scaled to address the rapid emergence of industry-wide threats.

Commitment to Industry-Wide Cyber Defense

OpenAI is prioritizing the maintenance of the "defender's window"—the period during which defenders can address vulnerabilities before they are exploited by attackers. To support this, the company is:

  • Making its most capable models available to Daybreak customers.
  • Providing $1 billion in subsidized access over six months for frontline defenders protecting essential services and digital infrastructure.
  • Sharing architectural insights and lessons learned from previous security sprints.
  • Publishing blueprints designed to empower cyber defenders across both government and private sectors.

These initiatives reflect OpenAI's broader strategy of using frontier AI capabilities to strengthen internal systems while simultaneously providing tools for external organizations to bolster their own security infrastructure.

Sources