OpenAI plans security hardening sprint with Cathedral

OpenAI said it is planning an internal security sprint with Cathedral, bringing Cathedral researchers into an exercise where they will use OpenAI models alongside company teams to test systems, challenge defenses and look for weaknesses.

The partnership adds external security researchers to the planned exercise. OpenAI did not provide a start date, duration or current execution status, nor did it identify the systems or models to be tested. The announcement reported no findings, completed tests, fixes or measured security improvement from the Cathedral sprint.

OpenAI said Cathedral will bring different expertise and approaches to finding weaknesses. It did not disclose commercial terms or say how many Cathedral researchers would take part.

OpenAI described the exercise as a continuation of an earlier company-wide security push. The company said the previous sprint assigned 25% of its product engineers to finding and fixing weaknesses. Codex helped investigate findings, reproduce vulnerabilities in isolated environments and prepare patches for review, according to OpenAI.

An AI pipeline for Linux kernel vulnerability testing offers related context on OpenAI’s broader security work with its models, but it provides no evidence about the planned Cathedral sprint.

In a separate account of the earlier sprint and the resulting Defense Factory workflow, OpenAI said it mobilized more than 250 people across more than 100 service areas and closed 53 urgent or high-priority issues on the first day. Those figures describe the company’s prior exercise, not results from the planned Cathedral sprint.

OpenAI’s published workflow says suspected weaknesses require reproduction evidence before they count as validated vulnerabilities. It also says a deployed fix requires verification evidence after human review and authorized deployment; accepted work or movement of a ticket alone does not prove that a vulnerability was fixed.