OpenAI said on Nov. 2 it is planning another internal security sprint, adding Cathedral as a partner and increasing payouts in its security bug bounty program, according to an OpenAI Blog post1.
The announcement sets out how OpenAI says it will test and patch weaknesses in its own systems, including using its models in that work. The company statement includes no independent test results.
OpenAI said the next sprint will bring new researchers and security partners together with internal teams to use its models to test and strengthen its systems, according to the OpenAI Blog1. It said Cathedral researchers will use OpenAI models alongside OpenAI teams to challenge the company's defenses.
The company also said it is more than quadrupling rewards for critical findings in its Security Bug Bounty program, according to the same OpenAI Blog post1. The post does not give the new payout schedule.
In the earlier sprint, OpenAI said it dedicated 25 percent of its product engineers to finding and fixing weaknesses, while using Codex to investigate findings, reproduce vulnerabilities in isolated environments and prepare patches for review, according to the OpenAI Blog1. Those details indicate staffing and workflow, but do not establish how many vulnerabilities were found, how severe they were or how the results compared with a prior baseline.
OpenAI said the expanded work reflects its view that traditional cyber defenses alone are no longer sufficient, according to the OpenAI Blog1.
The Nov. 2 post also said OpenAI is using its most capable models to strengthen its own defenses and making them available to Daybreak customers. It added that the company has committed $1 billion in subsidized access over six months for frontline defenders protecting essential services and digital infrastructure, according to the OpenAI Blog1. The post does not specify access terms for that subsidized usage or identify performance measurements for the models in defensive tasks.
OpenAI said it will also share its architecture and lessons from the last sprint, along with what it called a blueprint for cyber defenders, according to the OpenAI Blog1.