网络安全
OpenAI计划新的安全冲刺和融资臭虫奖
在 Google 上的首选来源中添加 Unite.AI
2026年11月2日，OpenAI 宣布计划与大教堂和其他外部研究人员进行另一次内部安全短跑，同时同一天的bug-bounty更新了融资奖赏和推出奖金，这些奖金可以将异常关键赔款提升到17.2万美元。
大教堂的研究人员将与其内部团队一起使用OpenAI的模型来挑战防御和寻找弱点。 公告涉及计划短跑，而非完成一轮测试。 Gavin Kliger, Cathedral的首席执行官兼联合创始人称合作将OpenAI的模型和安全专业知识与Cathedral的研究对齐，以发现弱点，测试修正和支持持续防御。
独立研究者更大的财富
根据OpenAI的单独bug-bounty公告，这些变化使中等、高和关键结果的奖励幅度平均翻了两番以上。 在ChatGPT,Codex或API平台等核心产品中，一个关键的脆弱性现在可以收入高达3万美元。 关于这些目标的特别关键调查结果仍然有资格在奖金前获得最多100 000美元。
高质量的报告将有资格获得基准赏金的乘数。 质量奖金承认了将虫子隔离的可靠概念证明，显示当它可以被利用时，并展示其影响。 一个新的五级忠诚计划新增缩放奖金给反复与OpenAI合作的研究人员，而优先活动则会提供专用奖金池来测试新的发布特征。
仍在等待颁奖的报告将采用新的范围。 在公告前30天内获奖的研究人员，将在新基数和忠诚奖支付更多时获得差额。
上一个冲刺通知国防工厂
较早的冲刺提供了操作模板。 OpenAI将25%的产品工程师用于发现和修复弱点，使用Codex来调查发现，在孤立的环境中复制弱点，并准备补丁以供审查。 其国防工厂账户称，动员了100多个服务区的250多人。
OpenAI报告说，早先的努力在第一天结束了53个紧急或高度优先的问题。 它查明了37%的调查结果是重复的，在运行时间复制了19.5%，并在动态验证后记录了0.81%的虚假阳性率。 补救完全基于Codex，回滚固定率为0.53%。
这些结果解释了为什么国防工厂不仅仅是一个补丁发电机。 其连续的，agent-First循环覆盖了库存，发现，动态验证，所有权分配和经核实的补救，agents在可复制，隔离的环境中工作。 随着agents的日常工作，人们审查相应的变化并处理模棱两可的案件。
设计中还附有一种材料资格：后续检查暴露了在全舰队部署的合并补丁和修补之间的缺口。 车票移动或被接受的工作不能证明是补救；经核实的补救阶段需要经过人员审查和授权的部署后部署和核查证据。
维权者访问 OpenAI
在自己的系统之外，OpenAI正在将其最有能力的模型提供给Daybreak 客户，用于授权的防御工作。 其2026年9月3日的"黎明"公告设定了为期6个月的消费目标，承诺投入10亿美元，涵盖补贴获取，培训，技术支持和伙伴关系，从受资源限制的美国维权者开始，提供水电等基本服务。
在作出这一宣布时，OpenAI报告说，在2 000个经批准的组织和工作空间中，已有数千名维护者使用了 " 黎明 " 系统，其中包括网络安全公司、国防组织和执法组织。
计划中的冲刺连接了这些内部和外部防御：外部研究人员得到更大的奖励来报告OpenAI的测试错过了什么，而它的agent-第一操作则是为了验证和修复弱点而构建的。 基准测试嵌入在OpenAI自己的设计中，是发现是否结束于部署的、独立核实的补救，而不是仅标注完票。
本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
Cybersecurity
OpenAI Plans New Security Sprint and Raises Bug Bounty Rewards
Add Unite.AI to your preferred sources on Google
OpenAI announced on November 2, 2026 that it is planning another internal security sprint with Cathedral and other outside researchers, while a same-day bug-bounty update raised rewards and introduced bonuses that can lift exceptional critical payouts to $172,000.
Cathedral researchers will use OpenAI’s models alongside its internal teams to challenge defenses and look for weaknesses. The announcement concerns a planned sprint, not a completed round of testing. Gavin Kliger, Cathedral’s CEO and co-founder, said the collaboration would pair OpenAI’s models and security expertise with Cathedral’s research to find weaknesses, test fixes and support continuous defense.
Larger Bounties for Independent Researchers
The changes more than quadrupled the midpoint of reward ranges for medium, high and critical findings on average, according to OpenAI’s separate bug-bounty announcement. A critical vulnerability in a core product such as ChatGPT, Codex or the API Platform can now earn up to $30,000. Exceptional critical findings on those targets remain eligible for up to $100,000 before bonuses.
High-quality reports will be eligible for a multiplier on the base bounty. The quality bonus recognizes a reliable proof of concept that isolates the bug, shows when it can be exploited and demonstrates its impact. A new five-tier loyalty program adds scaling bonuses for researchers who repeatedly work with OpenAI, while priority campaigns will provide dedicated bonus pools for testing newly launched features.
Reports still awaiting an award will use the new ranges. Researchers whose bounties were awarded during the 30 days before the announcement will receive the difference when the new base and loyalty awards would have paid more.
Previous Sprint Informs the Defense Factory
The earlier sprint supplies the operating template. OpenAI dedicated 25% of its product engineers to finding and fixing weaknesses, using Codex to investigate findings, reproduce vulnerabilities in isolated environments and prepare patches for review. Its Defense Factory account says the effort mobilized more than 250 people across more than 100 service areas.
OpenAI reports that the earlier effort closed 53 urgent or high-priority issues on its first day. It identified 37% of findings as duplicates, reproduced 19.5% at runtime and recorded a 0.81% false-positive rate after dynamic validation. Remediation was entirely Codex-based, with a 0.53% rolled-back fix rate.
Those results explain why the Defense Factory is more than a patch generator. Its continuous, agent-first loop covers inventory, discovery, dynamic validation, ownership assignment and verified remediation, with agents working in reproducible, isolated environments. People review consequential changes and handle ambiguous cases as agents take on routine work.
The design also carries a material qualification: follow-up checks exposed a gap between merged patches and fixes deployed across the fleet. Ticket movement or accepted work does not prove remediation; the verified-remediation stage requires deployment and verification evidence after human review and authorized deployment.
Defender Access Beyond OpenAI
Beyond its own systems, OpenAI is making its most capable models available to Daybreak customers for authorized defensive work. Its September 3, 2026 Daybreak announcement set a six-month consumption target for a $1 billion commitment covering subsidized access, training, technical support and partnerships, starting with resource-constrained U.S. defenders of essential services such as water and electricity.
At the time of that announcement, OpenAI reported that thousands of defenders across 2,000 approved organizations and workspaces already used Daybreak, including cybersecurity companies, defense organizations and law-enforcement organizations.
The planned sprint connects those internal and external defenses: outside researchers receive larger incentives to report what OpenAI’s testing missed, while its agent-first operation is built to validate and fix weaknesses. The benchmark embedded in OpenAI’s own design is whether findings end in deployed, independently verified remediation rather than tickets merely marked complete.
Auto-fetched and translated by AI Atlas. All rights belong to the original author.