OpenAI signs testing partnership with Hacktron, the firm that breached its systems through a bug bounty

OpenAI has turned a bug bounty relationship into a formal security partnership. On November 6 the company announced that it will work with Hacktron, a start-up that builds AI agents for code review, penetration testing and red teaming, to search for weaknesses in its own systems, according to reports from Unite.AI and DiarioBitcoin.

What the partnership covers

The work centers on the points where OpenAI's applications, identity systems and infrastructure connect to outside services, a surface the company says is growing as AI agents link services in new ways. Isolated flaws in individual products are also in scope. OpenAI engineers and Hacktron researchers are to choose the priority areas together, and OpenAI says it will use what it learns to harden its defenses.

The deal also widens Hacktron's access to frontier models through Daybreak Red, the tier OpenAI launched on August 10 for approved teams doing vulnerability research, exploit development and red teaming. Reports say the collaboration includes verification, monitoring, limited permissions and human oversight. Financial terms were not reported.

How the relationship began

OpenAI first met Hacktron through its Security Bug Bounty program and says it was impressed by the impact of the firm's findings. In an account it published in September, Hacktron described chaining remote code execution in the image-processing path of OpenAI's community forum, hosted on Discourse, with a single sign-on issue at OpenAI. That gave it access to several employees' ChatGPT accounts, with a possible path to Codex and a GitHub integration.

Hacktron says OpenAI confirmed a fix about 14 hours after the report. OpenAI paid a $6,500 bounty on September 1, and said the award covered the OpenAI-side flaw, not testing of the forum, which was out of scope. Hackread reported in September that the three-person team used Anthropic's Claude, including Claude Opus 5, to help build a working exploit, and that the whole chain took under 72 hours.

What remains unclear

The timeline and technical details come largely from Hacktron's own write-up and have not been independently verified. Hacktron has said its research was not fully autonomous and still depended on skilled human guidance. Neither company has said how long the partnership will last or whether its findings will be published.