OpenAI is bringing in Cathedral Systems — the security firm whose researchers recently found their way into rival Anthropic’s systems — to attack OpenAI’s own defenses, and it is raising critical bug bounties more than fourfold. Why it matters: the lab is paying outside hackers to find its weaknesses before someone less friendly does.
November 4, 2026 — AI News
What happened
OpenAI announced on November 2 that Cathedral Systems’ researchers will join a new internal security sprint, working alongside OpenAI’s own teams and using OpenAI’s models to look for weaknesses in its systems and check whether fixes actually work. Cathedral’s CEO and co-founder, Gavin Kliger, said the partnership would bring the firm’s researchers together with OpenAI’s teams to find weaknesses that might otherwise go unnoticed. OpenAI has not said when the sprint starts or which systems are in scope.
The bounty and the backstory
Alongside the partnership, OpenAI is increasing rewards in its Security Bug Bounty programme: payouts for critical findings rise more than four times, with exceptional findings eligible for up to $172,000 including bonuses. The sprint follows an earlier internal drive in which OpenAI assigned 25% of its product engineers to security work, using Codex to investigate reported problems, reproduce them in isolated environments and prepare fixes. OpenAI also said Daybreak customers get access to its models, with $1 billion in subsidised access over six months committed to organisations protecting essential services and digital infrastructure, and it plans to publish a guide so other companies and agencies can copy the approach.
Cathedral arrives with a notable résumé: in October its researchers used AI agents to find paths to internal information at Anthropic in under 12 hours, during authorised testing.
Why it matters
AI labs now defend systems that other AI systems attack, and OpenAI is treating that as a permanent contest rather than a one-off audit: outside researchers inside the building, its own models on defence, and bounty money large enough to compete with the black market for critical flaws. The test will be what the sprint actually finds — OpenAI has promised to share what it learned from the previous exercise, and this run will show whether that openness continues.
Frequently asked questions
What will Cathedral Systems do for OpenAI?
Cathedral’s researchers will work alongside OpenAI’s teams in a security sprint, using OpenAI’s models to find weaknesses in its systems and verify that fixes work.
How much is OpenAI paying for critical bugs now?
Rewards for critical findings have risen more than fourfold, with exceptional findings eligible for up to $172,000 including bonuses.
Who is Cathedral Systems?
A cybersecurity startup whose researchers, using AI agents in authorised testing in October, found paths into rival lab Anthropic’s internal systems in under 12 hours.
Sources: Gadgets 360, The Neuron, Interesting Engineering, OpenAI