OpenAI has turned one of its most embarrassing security incidents into a standing partnership. On November 6, 2026, the company announced it is working with Hacktron, the small offensive-security firm whose researchers chained two vulnerabilities together in July to reach OpenAI employees’ ChatGPT accounts and the company’s internal code repositories. The deal is a notable test of a simple idea: the people who found your worst holes are the best people to keep looking for more.
From a $6,500 bounty to a standing partnership
OpenAI says it first met Hacktron through its Security Bug Bounty program. The firm’s researchers reported the July attack chain, OpenAI confirmed a fix about 14 hours later, and the company paid a $6,500 bounty on September 1, 2026. Hacktron published its full write-up, “Hacking OpenAI,” on September 13. Now that one-off bounty relationship has become a formal testing partnership. Under the deal, engineers from OpenAI and researchers from Hacktron will jointly choose the highest-priority areas to test, rather than Hacktron working from a fixed list. Hacktron chief executive Zayne Zhang said the company is “excited to deepen our partnership with OpenAI, combining our offensive security expertise with their frontier models to help secure OpenAI and the broader software ecosystem.”
How Hacktron broke in: the July attack chain
The July incident is worth understanding because it explains exactly what the new partnership is meant to probe. On July 25, 2026, Hacktron’s researchers uploaded a carefully crafted HEIF image to OpenAI’s community forum at community.openai.com, which runs on Discourse. The forum’s image processing relied on a version of the libheif library with a known flaw, and the crafted file triggered a heap overflow that gave the researchers remote code execution on the forum server. From there, a flaw in OpenAI’s single sign-on let them take over the ChatGPT and Codex accounts of active forum members without any interaction from those users. Through GitHub permissions linked to Codex, they then reached OpenAI’s internal private code repositories. The whole chain took under 72 hours, caused no damage, and was reported responsibly through the bug bounty program. NBC News first reported the incident in September. One detail with an ironic twist: Hacktron used Anthropic’s Claude as an auxiliary tool during the penetration test.
Daybreak Red and the GPT-6 Cyber connection
As part of the partnership, Hacktron gets expanded access to OpenAI’s frontier models through Daybreak Red, the company’s restricted program for putting advanced AI in the hands of vetted defensive-security researchers. Daybreak Red is the tier that gates offensive security work, including red teaming and penetration testing. The timing is no coincidence: OpenAI opened its GPT-6 Cyber security model to selected Daybreak Red participants the day before the Hacktron announcement. That makes the partnership a two-way exchange. Hacktron brings its offensive expertise and its AI agents for code review, penetration testing and red teaming, and OpenAI supplies the frontier cyber models to test with. Readers who want the background on that model can read our earlier coverage of OpenAI’s GPT-6 Cyber security model. Hacktron’s research has repeatedly focused on the joins between applications, cloud infrastructure and identity systems, and those joins are precisely where this partnership is aimed.
Why the seams between services are the real target
The choice of focus is deliberate, and it is the most important part of the announcement. OpenAI’s systems increasingly connect to outside services — tools, data sources and other companies’ software — and those connections are where many modern breaches begin. The July breach proved the point: neither the forum software nor the sign-on system was an OpenAI model, yet the chain between them reached the company’s most sensitive code. The same pattern shows up across the industry. The Chainalysis breach showed how a single compromised dependency can expose live credentials at scale, and the November 2026 Android security update was a reminder that the most dangerous flaws often sit in shared components like media parsers rather than in headline features. Security teams have long known that the seams are the target; OpenAI is now paying a team that proved it to keep pulling at them. The company also said its security team will be at the PROMPT2PWN event in Oakland on November 20–21, where researchers can test targets in person.
What this means for AI security — and what to watch
The Hacktron deal is one of several security moves OpenAI made in the same week, and it signals a shift in how AI labs think about defence. Frontier models are no longer just the thing being protected; they are also the tools doing the testing. That raises the stakes on both sides. On the positive side, a standing partnership with joint scoping should find more realistic flaws than a bug bounty queue, because the testers can follow a chain wherever it leads instead of stopping at a single bug. The risk is concentration: giving one firm deep access to frontier cyber models is powerful, but it also makes the vetting and the guardrails around Daybreak Red as important as the testing itself. OpenAI’s own announcement discloses no new vulnerability and no finding — it describes an arrangement for deeper, jointly scoped testing, not a result. The honest measure of the partnership will be what Hacktron finds next, and whether OpenAI discloses it as openly as it did the July breach. For now, the message to the rest of the industry is clear: if you want to know where your systems break, hire the people who already broke them. That lesson applies well beyond AI labs. OpenAI’s acquisition of Pierre, which brought Codex’s code-storage expertise in-house, shows the same instinct in a different form — own the seams, or someone else will find them for you. For more on the week’s security news, see the SecNews coverage of the Hacktron deal and AI Weekly’s summary of the announcement, and the WebProNews report on the partnership has the fullest account of the July timeline.
The partnership is a bet that transparency and sustained adversarial testing beat quiet patching. OpenAI paid $6,500 for the lesson in July; now it is paying for the lesson to keep coming. If the arrangement works, the next Hacktron-style chain will be found by Hacktron — before anyone else finds it first.
