OpenAI and Hacktron test risks across connected AI services

By Elena Vasquez

OpenAI announced a partnership with Hacktron on November 6, 2026, to target vulnerabilities across connections to third-party services.

OpenAI's announcement says the deal expands the security firm's access to frontier models through Daybreak Red. OpenAI describes the partnership as an expansion of an existing bug-bounty relationship. That matters because AI agents can turn a single application flaw into access across identity systems, cloud infrastructure and connected services, according to the announcement. OpenAI said the tests will feed lessons into the company's defenses.

What will OpenAI and Hacktron test together?

OpenAI engineers and Hacktron security researchers will jointly select the highest-priority areas, according to OpenAI's announcement. The tests will examine how systems behave when AI agents connect services in new ways. OpenAI says the partnership has a specific target: weaknesses that emerge as applications, identity systems and infrastructure link together. Joint selection matters here because both sides will direct cyber-capable models toward interconnected systems rather than treating each service as an isolated testing target, according to OpenAI.

The arrangement combines OpenAI's knowledge of its service connections with Hacktron agents for code review, penetration testing and red teaming. According to OpenAI, engineers and security researchers from both sides will set the priorities before testing begins. Shared target selection gives both companies a say in what the partnership tests next. Hacktron already builds AI agents for code review, penetration testing and red teaming. OpenAI became familiar with the firm through its Security Bug Bounty program. OpenAI said it was impressed by the impact of vulnerabilities Hacktron's researchers found and disclosed. Hacktron's research has uncovered flaws in interactions among applications, cloud infrastructure and identity systems, OpenAI said. That experience lines up directly with the partnership's connected-services focus.

How did a forum flaw reach ChatGPT and Codex?

Hacktron's September 13, 2026 account provides the clearest example. Researchers said they chained two critical vulnerabilities on July 25, 2026. The chain compromised multiple OpenAI employees' ChatGPT accounts. It also created potential access to internal repositories and other connected services.

The first flaw enabled remote code execution in the image-processing path of the Discourse-hosted community forum. The second involved an OpenAI single sign-on issue. Together, they moved the forum compromise into ChatGPT and Codex, then a connected GitHub integration. The chain crossed organizational and technical boundaries in one sequence, linking a third-party forum, employee identity, developer tools, source control and OpenAI's internal code repository.

In Hacktron's account, the harmless pull request provided a limited proof of internal reach. The researchers stopped testing there rather than exploring the monorepo or reading sensitive internal code. Researchers reported the issues through OpenAI's Bugcrowd program and directly to Discourse. Hacktron's timeline says OpenAI confirmed a fix roughly 14 hours after the initial report. Discourse had a fix ready two days after receiving its report. Those response times came from Hacktron's reproduced timeline.

Why was the bounty limited to OpenAI's side?

OpenAI paid Hacktron a $6,500 bounty on September 1, 2026. According to Hacktron's reproduced timeline, the award recognized the OpenAI-side finding. It did not cover testing against the explicitly out-of-scope Discourse-hosted forum. That boundary matters because the exploit crossed from third-party infrastructure into OpenAI's own services, but payment remained tied to the eligible flaw under bounty rules.

For a bug-bounty program, the line between an eligible company flaw and an out-of-scope third-party target can determine payment even when the research demonstrates a much larger chain. Hacktron's account shows both halves at once: the researchers crossed the boundary to prove impact, while OpenAI limited the award to its own side. Hacktron reported the full chain through its reproduced timeline. Under that account, bounty eligibility followed the affected system even though the attack connected several systems. The bounty decision did not change the chain's potential reach, Hacktron said. The researchers had demonstrated potential access to internal repositories and other connected services.

How do Daybreak Red and Blue differ?

OpenAI's August 10, 2026 Daybreak announcement defined two access tiers. Red provides “access to purpose-trained cybersecurity models for authorized vulnerability research, exploit validation and security testing”. Blue provides frontier general-purpose models with safeguards tailored to authorized defensive work. OpenAI recommends Blue as the starting point for most defenders. Teams whose authorized work includes advanced vulnerability research, exploit development or red teaming can request Red access. That narrower request process separates advanced security work from the recommended general tier. For defenders, the distinction creates a graduated path: Blue for most authorized work, then Red access for advanced vulnerability research, exploit development or red teaming.

The choice controls how much access a team receives and under what conditions. OpenAI's recommendation leaves Blue as the starting point for defenders, while Red remains a request-based tier for work that requires specialized cybersecurity models. OpenAI's announcement treats model access as a controlled research resource, not an unrestricted release. Only approved individuals and organizations conducting authorized work can use either tier.

What controls govern agent-led testing?

OpenAI says only approved individuals and organizations conducting authorized work can access either tier. OpenAI lists five baseline controls:

• Identity verification.
• Account security.
• Monitoring.
• Approved-use restrictions.
• Legal attestations.

OpenAI's documented best practices add operating rules for security agents:

• Isolate security workflows from sensitive production systems and the open internet.
• Review agent actions outside the Codex sandbox before execution.
• Add human oversight for higher-risk workflows.
• Use scoped permission profiles to enforce authorized boundaries.

These controls operate at several layers. Identity verification and account security govern who can use the models. Monitoring and approved-use restrictions govern ongoing activity, while legal attestations tie access to authorized purposes. OpenAI's best practices then constrain where agents run and who reviews their actions. The controls address the risk of the partnership: stronger testing requires deeper system access, while broader access also increases the consequences of misuse or error. In an earlier account, Hacktron said the work was “not completely autonomous” and that “skilled human guidance remained important”. The researchers' assessment matches OpenAI's emphasis on oversight rather than fully autonomous testing.

What does the partnership change for OpenAI?

The agreement extends OpenAI's relationship with Hacktron beyond bug-bounty disclosures. Engineers and security researchers will now choose priorities together, according to OpenAI. Hacktron will also gain expanded access to frontier models through Daybreak Red. OpenAI said the lessons will strengthen its defenses as agents connect more services.

The new focus emphasizes chained paths across those connections. The July test linked image processing, single sign-on, ChatGPT, Codex, GitHub and an internal monorepo. Those relationships form the practical model for the partnership's new work. The partnership's policy stakes are concrete: deeper agent testing comes with identity checks, legal attestations, monitoring, sandbox review and scoped permissions at each approved tier.

The next measure of success will come from joint tests that expose cross-service weaknesses without crossing the partnership's authorized boundaries. The tests will show whether deeper model access can strengthen OpenAI's defenses without widening unauthorized access.