SafetyRisk, alignment & guardrails
OpenAI brings in Cathedral for its next security sprint and raises top bug bounties to about $172,000
OpenAI's next internal security sprint puts its teams alongside Cathedral, a startup whose agents reportedly got into parts of Anthropic's systems. They will use OpenAI's own models to attack its defenses, and bug bounties now reach about $172,000.
From the OpenAI News article of November 2, 2026 and cited sources: Cathedral researchers will join OpenAI teams in the next sprint and use OpenAI models to probe OpenAI's defenses. [3] [2]
SOURCES[3] RuntimeWire: Cathedral will use OpenAI models to test… runtimewire.com[2] Washington Post: Researchers at Cathedral got inside… washingtonpost.com
AT Pulse research deskPublished · Updated · 5 min read · AI-assisted analysisAI-assisted, not human-edited. Methodology Corrections Who owns this site
- What happened
- Cathedral researchers will join OpenAI teams in the next sprint and use OpenAI models to probe OpenAI's defenses. [3] [2]
- Original source
- OpenAI News article, company source
- Brief by
- AT Pulse research desk AI-assisted; publisher and contact on the desk page
- When
- November 2, 2026 article published
- Covered
- Nov 5 edition
- Evidence
- 12 sources across 11 sites
- 1OpenAI: Preparing our next security sprint to harden OpenAIopenai.com
- 2Washington Post: Researchers at Cathedral got inside…washingtonpost.com
- 3RuntimeWire: Cathedral will use OpenAI models to test…runtimewire.com
- 4Claims Journal (Reuters): OpenAI Employees Warned About…claimsjournal.com
- 5The Next Web: Former DOGE staffers raised $160M for…thenextweb.com
- 6RuntimeWire: OpenAI turns a 250-person security code red…runtimewire.com
RisingHow it’s measured
Hacker News · 2 likes · 2 comments
Reach blends public engagement (views, likes, comments, shares, stars) from the platforms where the story or its original source lives: YouTube, Hacker News, GitHub, Substack and similar. A video and the article written from its transcript share one score, taken from the video. Platforms with no data are left out rather than counted as zero, and the age of a story never lowers its score.
Cathedral researchers will join OpenAI teams in the next sprint and use OpenAI models to probe OpenAI's defenses. A week earlier, Cathedral's agents reportedly reached Anthropic's sales, HR and IT systems through third-party admin software. Anthropic says only a limited set of systems was reached and that customer data, source code and model weights were not. [3] [2]
Bug bounties for critical flaws in core products now start at up to $30,000. Exceptional findings carry a $100,000 base payout, which can reach about $172,000 with bonuses. Separately, OpenAI committed $1B in discounted model access over six months for teams protecting essential services. [10] [3] [9]
The sprint builds on OpenAI's September "Defense Factory," a five-stage agent pipeline: inventory, discovery, dynamic validation, assigning an owner, and verified fixes. Flaws are reproduced and patches tested in throwaway sandboxes, with humans overseeing. In OpenAI's own figures, 37% of findings were duplicates and only 19.5% could be reproduced at runtime, so most of the work goes into triage rather than discovery. [7] [11] [6]
Reuters, citing five sources, reported that OpenAI staff had warned leaders for years about broad access to the company's main code repository and little review of internal tools. OpenAI says sensitive work sits in separate, access-controlled repositories and that the main repository holds no model weights. [4]
What the evidence shows: OpenAI is turning AI-driven vulnerability hunting into an ongoing process and paying more for outside findings.
Read the full assessment
What it suggests: red-teaming with frontier models is becoming standard, and the hard part shifts from finding bugs to validating them and assigning owners.
The dossier is below. OpenAI's own announcement page refused automated access, so its details come from secondary reporting and are attributed that way.
Executive brief
OpenAI's next internal security sprint partners with Cathedral, a startup whose AI agents reportedly got into parts of Anthropic's corporate systems in under 12 hours a week earlier (Washington Post). Announced on November 2, 2026, the sprint puts Cathedral researchers alongside OpenAI teams, using OpenAI's own models to attack its defenses (OpenAI; RuntimeWire). OpenAI also raised its bug bounties: up to about $172,000 for exceptional findings. A day later, Reuters reported that OpenAI staff had warned leaders about operational-security weaknesses for years (Claims Journal/Reuters).
What changed and event timeline
Cathedral raises $160M
Four former DOGE staffers, including Gavin Kliger, raised money at a $1.4B valuation to build AI for US military cyber operations. a16z and Sequoia led the round ().
A quarter of engineers moved to security
Thibault Sottiaux reassigned about a quarter of OpenAI's product engineers to security work ().
"Defense Factory" published
OpenAI turned the first sprint (250+ people, 100+ service areas) into a continuous agent-driven pipeline for finding and fixing vulnerabilities (;).
Cathedral breaches Anthropic
Cathedral's agents reached Anthropic's sales, HR and IT systems through third-party admin software. Anthropic disputes how serious that was ().
Next sprint and higher bounties announced
Critical bounties for core products rise to $30,000 ().
Reuters reports staff warnings
Five sources described broad monorepo access and little review of internal tools, with concerns dating back before ChatGPT's launch ().
Capabilities and access
- Models: OpenAI has not named the exact model for the next sprint.
- External access: OpenAI offers its strongest cyber models to customers of Daybreak, its security product.
- Bounties: up to $30,000 base for critical core-product flaws; $100,000 base for exceptional findings, reaching about $172,000 with bonuses (eSecurity Planet).
Read the full section
- Models: OpenAI has not named the exact model for the next sprint. The first sprint used Codex to investigate findings, reproduce them in isolated environments and draft patches (BigGo Finance). One outlet names "GPT-5.6 Sol" for the Defense Factory work (RuntimeWire); another says only "frontier models" (Cybersecurity News).
- External access: OpenAI offers its strongest cyber models to customers of Daybreak, its security product. It also committed $1B in discounted access over six months for teams protecting essential services (Tech City Authority).
- Bounties: up to $30,000 base for critical core-product flaws; $100,000 base for exceptional findings, reaching about $172,000 with bonuses (eSecurity Planet).
Technical analysis for researchers and developers
The Defense Factory runs in five stages: inventory, then discovery, dynamic validation, assigning an owner, and verified remediation. Two numbers show where the hard work sits: That puts most of the engineering effort into triage and validation, not raw discovery. No public benchmark, dataset or independent replication exists.
Read the full section
The Defense Factory runs in five stages: inventory, then discovery, dynamic validation, assigning an owner, and verified remediation. A shared SECURITY.md file gives agents context, and reproduction and patch testing happen in throwaway sandboxes with humans overseeing the process (Cybersecurity News; Ken Huang). It connects to GitHub, GitLab, Snyk, Semgrep, Jira and ServiceNow.
Two numbers show where the hard work sits:
- 37% of findings were duplicates.
- Only 19.5% could be reproduced at runtime.
That puts most of the engineering effort into triage and validation, not raw discovery. No public benchmark, dataset or independent replication exists.
Claims and evidence
All of these come from OpenAI; no independent audit exists:
Read the full section
All of these come from OpenAI; no independent audit exists:
- First-day result: 53 urgent or high-priority issues closed (eSecurity Planet).
- Quality metrics: 0.81% false positives after dynamic validation, 0.53% of Codex-generated fixes rolled back, and owners accepted 90.6% of routed findings (Cybersecurity News).
- Bounty increase: critical payouts went up "more than fourfold" (RuntimeWire). The earlier baseline is not stated in the reviewed sources.
- Cathedral's Anthropic breach: reported mainly from Cathedral's draft report, and Anthropic disputes the scope (Washington Post).
Context and prior work
- The sprint follows OpenAI's September Defense Factory blueprint and is framed as a repeating cycle (BigGo Finance).
- OpenAI's stated reasoning: as AI gets better at finding vulnerabilities, defenders need to use it before attackers do (RuntimeWire).
- Reuters also reports that Hacktron AI researchers used an Anthropic model to get into ChatGPT employee accounts and OpenAI's monorepo (Claims Journal/Reuters).
Read the full section
- The sprint follows OpenAI's September Defense Factory blueprint and is framed as a repeating cycle (BigGo Finance).
- OpenAI's stated reasoning: as AI gets better at finding vulnerabilities, defenders need to use it before attackers do (RuntimeWire).
- Reuters also reports that Hacktron AI researchers used an Anthropic model to get into ChatGPT employee accounts and OpenAI's monorepo (Claims Journal/Reuters).
- Dane Stuckey has been OpenAI's CISO since October 2024 (same source).
Limitations, safety and contested findings
- Cathedral's breach claims are disputed. Anthropic says Cathedral reached "a limited set" of systems.
- It says sensitive work sits in separate, access-controlled repositories and the monorepo does not hold model weights (Claims Journal/Reuters).
- Outcome data is thin. OpenAI has published no full outcome data from the first sprint (BigGo Finance).
Read the full section
- Cathedral's breach claims are disputed. Anthropic says Cathedral reached "a limited set" of systems. It says customer prompts, Claude responses, source code and model weights were not reached, and that Cathedral overstated the national-security angle and did not fully follow bounty rules (Washington Post).
- OpenAI disputes the Reuters picture. It says sensitive work sits in separate, access-controlled repositories and the monorepo does not hold model weights (Claims Journal/Reuters).
- Outcome data is thin. OpenAI has published no full outcome data from the first sprint (BigGo Finance).
- Faster detection may not shorten exposure. Patch validation and rollout can still leave confirmed flaws exploitable (eSecurity Planet).
- Testing may not fix structure. Critics question whether outside testing can fix systemic access-control problems or only expose them (The Neuron).
Business and practitioner implications
- AI-assisted red-teaming is becoming standard practice.
- Plan for triage, not just discovery.
- The bounty bar is rising. Six-figure bounties raise the market rate for critical AI-platform bugs.
Read the full section
- AI-assisted red-teaming is becoming standard practice. Bringing in an outside team that has already breached a rival signals that buyers now want adversarial testing done with frontier models.
- Plan for triage, not just discovery. The 37% duplicate and 19.5% reproduction figures suggest most of the cost is in deduplication, validation and assigning owners.
- The bounty bar is rising. Six-figure bounties raise the market rate for critical AI-platform bugs.
- Vet partners carefully. Cathedral is military-focused and its Anthropic engagement is disputed, so scope, rules of engagement and disclosure terms need tight contracts.