November 2, 2026
SecurityPreparing our next security sprint to harden OpenAI
Weβre planning our next internal security sprint at OpenAI, bringing new researchers and security partners together with our own teams to use our models to test and strengthen our systems. Weβre partnering with Cathedral, whose researchers will use OpenAIβs models alongside our teams to challenge our defenses, bringing differentiated expertise and approaches to finding weaknesses and helping us protect our platforms.
βOpenAI is setting an important example by partnering with outside security firms and using its own models to continuously test and strengthen its defenses. Every company should be thinking about how to put these capabilities to work. Weβre excited to collaborate with OpenAIβs teams, combining their models and security expertise with our research to find weaknesses, test fixes and strengthen this approach to continuous defense.β
Weβre also making improvements to our Security Bug Bounty program including more than quadrupling our rewards for critical findings. We want researchers to challenge our assumptions and help strengthen both our systems and the methods we use to defend them.
This is part of our ongoing effort to use AI to continuously find and fix weaknesses in our systems. Our last sprint showed what this approach can deliver. We dedicated 25% of our product engineers to finding and fixing weaknesses in our systems. Using Codex, engineers investigated findings, reproduced vulnerabilities in isolated environments and prepared patches for review.
Weβre building on that work because traditional cyber defenses alone are no longer sufficient. Recent incidents across the industry show how quickly threats can emerge and how important it is to build continuous defensive loops to find and fix weaknesses before attackers do.
Keeping the defenderβs window open requires organizations to use frontier cyber capabilities to harden their systems. Weβre using our most capable models to strengthen our own defenses and making them available to Daybreak customers. Weβve committed $1 billion in subsidized access over six months for frontline defenders protecting essential services and digital infrastructure. Weβre also sharing our architecture and lessonsβ from the last sprint, alongside our blueprint for empowering cyber defenders across industry and government.
Weβll keep advancing our models, using them to strengthen our own systems, and expanding access for trusted defenders. Keeping the defenderβs window open will take action across the industry, and that work needs to start now.
