OpenAI brings in Cathedral for its next AI-assisted security sprint and lifts top bug bounty to $172,000
Cathedral researchers will use OpenAI's models alongside its teams to attack its defences; a critical bug in ChatGPT, Codex or the API now pays up to $30,000, and the sprint's start date is not given.
Why it matters
OpenAI says traditional cyber defences alone are no longer sufficient and is turning its own models on its systems before attackers do. Its last sprint put 25% of product engineers on finding and fixing weaknesses with Codex; this one adds an outside red team and much larger bounties, more than quadrupling the midpoint of reward ranges for medium, high and critical findings on average. It follows a $1 billion pledge of subsidised access for frontline defenders. Watch for what the sprint finds and whether OpenAI publishes results as it did last time.
Key facts
- Partner: Cathedral
- Critical core-product bug: up to $30,000
- Exceptional findings: up to $172,000 with bonuses
- Reward midpoints more than quadrupled on average
- Last sprint used 25% of product engineers with Codex
- $1 billion subsidised access for frontline defenders over six months