OpenAI will bring researchers from Cathedral, a cybersecurity startup founded by former Department of Government Efficiency staffers, into its next internal security sprint. The researchers will use OpenAI’s models alongside its own teams “to challenge our defenses,” OpenAI said on November 2, when it also raised payouts in its bug bounty program.
Gavin Kliger, Cathedral’s chief executive and co-founder, said in OpenAI’s announcement that the two companies would combine OpenAI’s models and security expertise with Cathedral’s research “to find weaknesses, test fixes and strengthen this approach to continuous defense.” The announcement does not say when the sprint will begin, which systems it will cover or whether Cathedral is being paid.
Kliger co-founded Cathedral with Luke Farritor, Marko Elez and Jack Stein, Reuters reported in July, citing people familiar with the matter. The company raised $160 million at a $1.4 billion valuation in a round led by Andreessen Horowitz and Sequoia Capital, and planned to pursue US government contracts for AI-driven cyber operations, offensive and defensive, against adversaries such as China, according to the report. Kliger had until recently been the Pentagon’s chief data officer. Reuters also reported that Cathedral was looking to buy a data center, or partner with a provider, to supply dedicated computing power for cyber operations.
OpenAI’s previous sprint put a quarter of its product engineers to work finding and fixing weaknesses in its systems. They used Codex, the company’s coding agent, to investigate findings, reproduce vulnerabilities in isolated environments and prepare patches for review. OpenAI said “traditional cyber defenses alone are no longer sufficient,” pointing to recent incidents across the industry.
The bug bounty changes raise the midpoint of OpenAI’s reward ranges for medium, high and critical findings more than fourfold on average, the company said. A critical vulnerability in ChatGPT, Codex or the API platform can now earn up to $30,000 before bonuses. In an illustrative example, OpenAI said a one-click ChatGPT account takeover that would previously have earned $6,500 could now pay $51,577 with multipliers for report quality, researcher loyalty and priority campaigns. Exceptional critical findings remain eligible for up to $100,000, and now up to $172,000 with bonuses.
OpenAI will apply the new ranges to reports it has not yet paid and make up the difference on awards from the previous 30 days. It also said it has committed $1 billion in subsidized access over six months for defenders protecting essential services and digital infrastructure through Daybreak, its program offering advanced cyber models for defensive work.
Sources: OpenAI, OpenAI bug bounty update, Reuters
–
By the Control Plane Editorial Team