OpenAI partners with Cathedral to bolster AI security

A new defensive alliance

OpenAI has announced a new partnership with Cathedral, a cybersecurity startup, to strengthen the security of its AI platforms. The company intends to use Cathedral's expertise to challenge its defenses and find hidden weaknesses in its models. This collaboration is part of a broader effort to protect AI tools from external hacks as cybercriminals increasingly use AI to launch attacks.

To encourage more external help, OpenAI is also significantly increasing its incentives for security researchers. The company stated it is "more than quadrupling our rewards for critical findings" through its bug bounty program. While the exact new amount was not specified, a previous update in March of last year showed rewards jumping from $20,000 to $100,000.

The move comes as the industry faces a period of heightened anxiety over digital infrastructure. OpenAI recently launched a global initiative called "patch the planet" to identify and resolve security vulnerabilities in popular software. This follows a recent discovery of major flaws in PHP, a programming language that undergirds roughly 70% of the world's websites.

The hackers turned allies

Cathedral is a relatively mysterious company that gained notoriety for its actions against another AI lab, Anthropic. The startup reportedly hacked into Anthropic's private systems as part of a bug bounty program, gaining access to Slack messages, job offers, and meeting transcripts. Anthropic's cybersecurity lead, Logan Graham, noted that the hack was "unusual and out of scope" because it relied on multiple third-party vulnerabilities.

Despite the controversy, OpenAI is bringing Cathedral on board to use their models alongside their own teams. The goal is to create a "continuous defensive loop" where experts find and fix weaknesses before malicious actors can exploit them. By hiring a firm that has already proven it can bypass high-level security, OpenAI is essentially hiring the best

The DOGE connection

The founders of Cathedral are notable figures with ties to Elon Musk's previous government initiatives. The team includes former deputies from the Department of Government Efficiency (DOGE), which was tasked with cutting federal spending. These founders have backgrounds in high-stakes environments, including SpaceX and the U.S. Department of War.

The company's leadership includes Gavin Kliger, who served as a chief data officer at the Department of War, and Luke Farritor, a Thiel Fellow who used AI to decipher ancient scrolls. Other co-founders include Marko Elez, who worked at X and xAI, and Jack Stein. Despite their high-profile backgrounds, Cathedral maintains a very secretive public presence.

The startup's website is minimalist, featuring only its name on a black screen. Its social media profile is equally sparse, offering only the vague description of "Securing critical American infrastructure." Reports suggest the company's mission may involve strengthening the U.S. military's cyber capabilities against foreign adversaries like China.

A shifting security landscape

The partnership highlights a growing trend of "offensive" security in the tech world. Instead of just building walls, companies are now hiring specialists to actively try to break into their own systems. This approach is becoming necessary as the tools available to hackers become more sophisticated and automated.

The recent PHP vulnerability crisis served as a wake-up call for the entire tech sector. Because so many websites rely on that specific language, the flaws created a "Y2K-like moment of panic" that forced governments to take sites offline. OpenAI's involvement in the "patch the planet" effort shows they are positioning themselves as a leader in global infrastructure safety.

Moving forward, the success of this partnership will depend on how effectively Cathedral can identify non-obvious flaws in OpenAI's models. As the company quadruples its rewards, it will likely see a surge in submissions from independent researchers. This multi-layered defense—combining internal teams, external specialists, and a global community of researchers—is the new standard for AI safety.