I watched an engineer scroll through a stolen Slack thread: job offers, candid meeting notes, a calendar full of private planning. They paused, looked up, and said Cathedral had been inside Anthropic in hours, not days. You felt the chill—if someone can read that much, what else are we leaving unlocked?
I’m going to walk you through what OpenAI’s decision to hire Cathedral really means for you and for the AI ecosystem. I’ll point out the risks, the likely gains, and the strange little signals the press releases leave out.
A string of public vulnerabilities has turned security into a front-page problem.
Last month’s PHP flaws forced governments and companies to take sites offline. OpenAI’s own model helped find those bugs, and the company launched a global effort called “patch the planet.” That reality — code that runs roughly 70% of the web suddenly behaving like a time bomb — is why OpenAI says it’s “more than quadrupling our rewards for critical findings.”
OpenAI cited prior moves that raised bounty payouts from $20,000 (€18,000) to $100,000 (€92,000). The new language suggests an even larger uplift, and OpenAI says Cathedral will work with its teams and models to “challenge our defenses.” All of that reads like a speeded-up bug-hunt: public, urgent, and expensive.
Why did OpenAI hire Cathedral?
You should care because OpenAI is asking a controversial, secretive team to probe the very systems that power ChatGPT and developer APIs. Cathedral is a startup founded by alumni of Elon Musk’s Department of Government Efficiency (DOGE). It raised $160 million (€147 million) and claimed a $1.4 billion (€1.3 billion) valuation in its early round backed by Andreessen Horowitz and Sequoia Capital.
Cathedral’s methods and origins are unusually public and unusually opaque at once.
The company is best known for getting into Anthropic’s private systems during that lab’s bug bounty process — a claim Cathedral said took under twelve hours, while Anthropic’s Logan Graham put the timeline at several days and said the most sensitive systems were untouched. That mismatch matters: it’s not just about speed, it’s about what “inside” actually meant.
You’ll hear the word “bug bounty” and picture a structured program. Cathedral’s approach, Anthropic says, relied on chaining multiple third-party weaknesses — not the kind of straight-line test most programs anticipate. The optics are messy: hiring the hacker who found a hole is smart, but it can feel like handing a locksmith the house keys — you want the locks changed, not the locksmith owning copies.
Is Cathedral trustworthy enough to test OpenAI’s defenses?
Trust is messy here. Cathedral’s founders — Gavin Kliger, Luke Farritor, Marko Elez, and Jack Stein — come from DOGE, SpaceX, xAI, Databricks and government posts, and one founder’s public controversies drew headlines while at DOGE. Cathedral’s web presence is minimal: a black homepage and an X profile that simply says, “Securing critical American infrastructure.” The team’s backers include marquee VCs, which signals investor confidence even as public scrutiny grows.
OpenAI’s play is partly PR, partly triage, and partly an attempt to build a new security feedback loop.
OpenAI framed this as a defensive sprint: models, red teams, and external specialists working together. They’ll run Cathedral’s tests alongside internal teams and pay more for critical discoveries. That’s practical: higher bounties and outside perspectives often accelerate fixes — but they also shift risk onto the public conversation.
This partnership is a fast-moving patch on top of a fragile stack. The PHP incident showed how quickly an industry-wide weakness can cascade; hiring Cathedral is meant to shorten the window between discovery and fix. At the same time, the move raises questions about disclosure, liability, and whether private security firms should be the gatekeepers for public tools like ChatGPT and Claude.
Anthropic, OpenAI, and the market are now playing a high-stakes game of trust.
Anthropic said Cathedral’s test was out of scope and used multiple third-party vulnerabilities; Cathedral said it was testing under a bug bounty program. You and I are left with two competing accounts and one practical worry: models and the services around them store a lot of conversations, job offers, and internal decisions.
Security here is not a single fix but an ongoing loop: find, report, patch, repeat. Cathedral’s work could tighten those loops, or create new single points of failure. Think of it as a tinderbox waiting for a spark: the spark may be a helpful report or a public exploit.
So where does that leave you? If you build on OpenAI or Anthropic APIs, watch for new disclosures, updated SDKs, and elevated bug-bounty payouts. If you care about public policy, note that a private firm with military-intent messaging and secretive posture is now working inside a tech giant’s defenses. And if you follow the people involved — Elon Musk, Logan Graham, Andreessen Horowitz, Sequoia Capital — you’ll see influence and money steering the conversation.
There are smarter ways to harden models and infrastructure: stronger supply-chain checks, clearer scope documents for bounty programs, and independent audits that publish findings. OpenAI’s public signal is clear — more money, more partners — but the harder work is agreeing on the rules of engagement and on who gets to speak when things go wrong.
Do you feel safer knowing the team that breached one lab is now paid to test another, or do you think that raises the stakes for everyone involved?