Partnering with Hacktron to find vulnerabilities in OpenAI’s systems

What happened

On November 6, 2026, OpenAI announced a partnership with cybersecurity firm Hacktron to identify and address vulnerabilities in its systems, with a focus on third-party service integrations. The collaboration expands Hacktron’s access to OpenAI’s advanced cybersecurity models through the Daybreak Red program. OpenAI engineers and Hacktron researchers will jointly select and test high-priority areas where AI systems interact with external services. The partnership builds on Hacktron’s previous work, which uncovered critical flaws in OpenAI’s connected services.

Key details

• Hacktron previously discovered and reported a vulnerability chain on July 25, 2026, affecting ChatGPT accounts and connected GitHub integrations.
• OpenAI paid Hacktron a $6,500 bounty for findings related to its systems, with fixes implemented within 14 hours of the initial report.
• The Daybreak Red program provides selected researchers access to specialized AI models for authorized security testing.
• Access to Daybreak Red is restricted to approved individuals and organizations, with identity verification and monitoring requirements.
• OpenAI’s best practices require isolating security workflows, human oversight, and scoped permissions for testing.

Why it matters

Organizations that use OpenAI’s products and services are directly affected, as the partnership aims to strengthen protections against vulnerabilities in systems that connect with third-party services. Security researchers and approved partners now have expanded, but controlled, access to advanced AI models for vulnerability testing. This change introduces new procedures and oversight for those conducting security research on OpenAI’s platforms, potentially reducing the risk of security breaches for customers and partners.