OpenAI is preparing another internal security-hardening sprint with researchers from Cathedral working alongside its own teams. The November 2 announcement describes planned defensive work using OpenAI models to find weaknesses and test improvements to its systems.
What the planned collaboration covers
Cathedral's researchers will bring outside expertise and use the models with OpenAI staff to challenge the company's defences. The announcement is about the intended process. It does not present a completed set of results from the forthcoming sprint.
OpenAI also says it is improving its Security Bug Bounty programme, including more than quadrupling rewards for critical findings. The announcement should be read alongside the actual programme details before assuming a particular report is eligible or attaching a specific payout to a vulnerability.
What OpenAI reports from its earlier sprint
The company says it previously dedicated a quarter of product engineers to finding and fixing weaknesses. It describes engineers using Codex to investigate findings, reproduce issues in isolated settings and prepare patches for review.
That sequence matters because finding a problem and safely resolving it are separate tasks. Reproduction, assessment and review help determine whether a proposed patch addresses the issue without creating a different operational problem.
What other teams can learn
The broader approach is to make defensive work a recurring process rather than a one-off demonstration. A bounded exercise should have an authorised scope, a way to triage findings and a defined path from a reproducible issue to a reviewed fix.
Those are practical evaluation criteria, not a claim that every organisation should copy OpenAI's allocation or tooling. The announcement provides a company account of one earlier sprint and plans for another. It does not establish that AI-assisted testing finds every weakness or that outside participation, by itself, proves the security of a deployed service.