OpenAI announced on November 2, 2026 that it is planning its next internal security sprint, bringing new researchers and security partners together with its own teams to use OpenAI's models to test and strengthen its systems. According to the company, it is partnering with Cathedral, whose researchers will use OpenAI's models alongside OpenAI teams to challenge its defenses and find weaknesses. OpenAI also said it is making changes to its Security Bug Bounty program, including more than quadrupling rewards for critical findings. The company described its previous sprint, in which it said it dedicated 25% of its product engineers to finding and fixing weaknesses, with engineers using Codex to investigate findings, reproduce vulnerabilities in isolated environments and prepare patches for review. OpenAI stated that 'traditional cyber defenses alone are no longer sufficient' and pointed to recent industry incidents. The company said it is making its most capable models available to Daybreak customers and has committed $1 billion in subsidized access over six months for frontline defenders protecting essential services and digital infrastructure. OpenAI said it is sharing its architecture and lessons from the last sprint along with a blueprint for cyber defenders across industry and government. The announcement comes from OpenAI directly; independent verification of the claimed outcomes was not provided in the source text.
- OpenAI announced its next security sprint on November 2, 2026, partnering with a firm called Cathedral.
- The company says it more than quadrupled rewards for critical findings in its Security Bug Bounty program.
- OpenAI committed $1 billion in subsidized model access over six months for frontline defenders of essential services.
What it means for you
A vendor is describing how it secures its own systems and offering subsidized tools to organizations that defend critical infrastructure. For most organizations, this is a signal about the direction of AI-and-security work, not something you need to act on. It does not change the security of the OpenAI products you already use today.
Try this
If you run any operation that depends on AI tools, use this as a prompt to check one thing: do you know who on your team owns your response plan when a tool you rely on has an outage or breach? Write down that name.
Who should care
Security and IT leads at organizations defending essential services or digital infrastructure, and anyone who runs a bug bounty or vulnerability program.
Skip this if
You're a general business using ChatGPT or similar tools for everyday work. This is OpenAI describing its internal process and a program aimed at infrastructure defenders — nothing here requires action from you.
Sources: OpenAI — read the original