OpenAI adds Cathedral Systems to its Security Sprint to test its defenses

OpenAI has added Cathedral Systems to its Security Sprint program, bringing in an outside party to test the company's defenses, according to a report surfaced through Google News.

Security Sprint functions as a mechanism for concentrating work on security issues. Adding an external team reframes testing as cross-checking among multiple parties rather than a job handled entirely in-house.

The report does not detail Cathedral Systems' testing scope, timeline, or deliverables, nor whether the work touches model weights, API services, or infrastructure.

Even so, outsourcing defense validation is itself a signal. As models gain capability and the attack surface shifts from prompts to tool calls and agent execution, self-assessment alone is increasingly hard to sell to enterprise customers and regulators.

For OpenAI, publishing the roster of a security program is also narrative management. It turns security spending from a verbal commitment into an organizational arrangement that outsiders can question.

The next things to watch are whether results appear as a public report or vulnerability disclosure, and whether external defense evaluation becomes standard practice among frontier model developers.