The announcement came second
Sequence matters here, and Reuters states it plainly. Its reporters had been gathering accounts of OpenAI’s internal security practices from five people familiar with them. After Reuters sought comment for the story, OpenAI published a blog post on Monday announcing its next internal security sprint. The investigation ran the following day.
None of that proves the sprint exists because of the inquiry. Companies sit on announcements and release them when scrutiny arrives; the post may have been scheduled for weeks. But the order of events is now part of the record, and it frames how the announcement should be read: not as a routine product note, but as a statement published while the company was responding to Reuters’ questions about its internal security practices. The timing is part of the record, even though it does not establish why OpenAI chose that moment to announce the sprint.
What the post says is concrete enough. Cathedral Systems, whose researchers previously reported accessing parts of Anthropic’s corporate systems, will send researchers into OpenAI’s next sprint to use OpenAI’s own models against OpenAI’s defenses. OpenAI says its previous sprint put a quarter of its product engineers on finding and fixing weaknesses, with Codex reproducing vulnerabilities in isolated environments and drafting patches. A companion post raises the price of outside help: the midpoints of the bounty ranges more than quadrupled. A critical vulnerability in a core product such as ChatGPT, Codex or the API Platform now qualifies for up to $30,000. Exceptional critical findings can receive up to $100,000 before bonuses, with OpenAI’s illustrative calculation reaching $171,925 after quality, campaign-priority and loyalty bonuses. Reports already submitted but not yet awarded will be assessed under the new ranges. Awards made during the 30 days before the announcement will also be topped up if the revised ranges would have produced a higher payment. OpenAI also committed $1 billion in subsidized access over six months for frontline defenders through its Daybreak effort, extending the announcement beyond its own security testing and bounty program.
What the warnings were actually about
Reuters’ account is not that OpenAI ignored security in the abstract. It is specific about mechanisms. Most of the company’s code lived in one repository, and anyone with code access could read the technical details of projects far from their own work, including sensitive ones. Research documentation sat, in the past, on GitHub and Slack. Internal tools, including the sandboxes where researchers test new models, were modified by employees without regular security reviews, according to three of Reuters’ sources. Staff raised versions of these concerns with senior leaders and the board before ChatGPT launched, and some left those conversations believing the race with Google and Anthropic mattered more.
OpenAI’s reply, given to Reuters, narrows each point rather than denying the picture outright. Its most sensitive work, it says, is kept in separate repositories under strict controls; the monorepo does not hold all of its code or the model weights; access to sensitive work has been restricted; internal tools now get regular reviews under a chief information security officer who joined in October 2024. Those are OpenAI’s descriptions of its current safeguards. They qualify Reuters’ account of access and internal reviews, but do not independently establish what controls were in place during the earlier period described by the sources.
The incidents Reuters strings along the timeline explain why the argument stopped being theoretical. In 2023, researcher Leopold Aschenbrenner circulated an internal memo titled "OpenAI is China’s leading AI lab" after an outsider hacked the company and obtained GPT-4-related information. OpenAI said the hacker accessed only company-wide Slack channels. The memo was shared with some board members. In July, a security firm says its researchers used a rival lab’s model to break into employees’ ChatGPT accounts and reach internal systems, the monorepo among them. In October, federal agents arrested an OpenAI engineer accused of hiding a recording device in an executive conference room. Each episode maps onto a warning that, on Reuters’ reporting, predates it: broad access and unreviewed tools. The Hacktron episode adds another dimension: researchers reportedly used a rival AI model to help navigate an attack that reached OpenAI’s internal systems, including its monorepo. Tools that can search, interpret and act across large codebases make existing access-control weaknesses more consequential.
What outside testers can and cannot settle
Bringing in Cathedral adds an outside team with experience testing another AI company’s corporate systems. But OpenAI has not disclosed which systems Cathedral will examine, what access it will receive, or how long the exercise will run. The higher bounties widen the same effort to independent researchers, offering stronger financial incentives to report vulnerabilities. Reuters separately reported that, in August, executive Thibault Sottiaux reassigned a quarter of OpenAI’s production engineers to security infrastructure. OpenAI’s own description of its previous security sprint refers to 25% of product engineers. The company has not established that these were the same allocation or initiative, but both accounts point to substantial engineering capacity being directed toward security.
What a sprint cannot settle is the governance question underneath. The warnings Reuters describes were not missed vulnerabilities; they were judgments about how much access a fast-moving research culture should grant, raised by employees and weighed, on their account, against speed. A penetration test measures whether a door can be forced. It does not measure whether the organization still wants the door where it is, or how quickly it acts when its own staff say the lock is wrong. OpenAI has published no start date for the sprint, no list of systems in scope and no commitment to report what Cathedral finds. Until some of that exists, the verifiable parts of this story are the money and the sequence: $172,000 at the top of a repriced table, announced the day before an investigation into why the table needed repricing.
Sources
- [1] OpenAI, "Preparing our next security sprint to harden OpenAI," November 2, 2026 (read first-hand in full at Gate 1 — Cathedral’s researchers "will use OpenAI’s models alongside our teams to challenge our defenses, bringing differentiated expertise and approaches to finding weaknesses"; the last sprint "dedicated 25% of our product engineers to finding and fixing weaknesses", with Codex used to investigate findings, reproduce vulnerabilities in isolated environments and prepare patches for review; "$1 billion in subsidized access over six months" for frontline defenders through Daybreak)Read source
- [2] OpenAI, "Rewarding defenders with bigger bug bounties," November 2, 2026 (read first-hand in full at Gate 1 — "more than quadrupling the midpoint of our reward ranges for medium, high, and critical findings on average"; a critical vulnerability in a core product up to $30,000; exceptional critical findings up to $100,000, and up to $172,000 with bonuses; the worked exceptional example, $100,000 × 1.15 quality × 1.30 priority campaign × 1.15 loyalty = $171,925, with all scenarios and historical awards labeled illustrative; reports submitted but not yet awarded priced at the new ranges, and awards from the 30 days before the announcement topped up; the security team at PROMPT2PWN, Oakland, November 20–21)Read source
- [3] Reuters (Deepa Seetharaman), "OpenAI employees warned about operational security lapses for years, sources say," November 3, 2026, updated November 4, 01:29 UTC (read first-hand in full at Gate 1 via KWSN’s syndication of the Reuters wire text — five people familiar with OpenAI’s practices on the warnings and monorepo access; three on the unreviewed internal tools; two on the strategy shift, including Thibault Sottiaux’s August reassignment of a quarter of production engineers; the Aschenbrenner memo and OpenAI’s qualification that the hacker accessed only company-wide Slack channels; Hacktron AI’s July account; the Alfozan arrest; the summer Hugging Face incident; OpenAI’s responses via spokesperson Elana Widmann; and the closing sequence: after Reuters sought comment for the story, OpenAI announced its "next internal security sprint")Read source
- [4] The Neuron, "OpenAI Security Warnings: Can Outside Hackers Help?" November 4, 2026 (the November 4 synthesis pairing the sprint announcement with the Reuters investigation)Read source
- [5] ALFW, "Cathedral Says Its AI Agents Reached Anthropic Systems in Under 12 Hours. The Route Was Office Software." October 26, 2026 — ALFW’s prior coverage of the Cathedral/Anthropic test, cross-referenced for the fuller account of that episode, including the under-12-hours claim and Anthropic’s response, rather than as a source for new claimsRead source