Skip to content
NewsIncident

OpenAI gives Hacktron deeper model access to hunt vulnerabilities in its own systems

· by

The short version

OpenAI said on November 6, 2026 that Hacktron's security researchers will get expanded access to its Daybreak Red model tier to test how OpenAI's products connect to third-party services.

OpenAI gives Hacktron deeper model access to hunt vulnerabilities in its own systems

OpenAI said on November 6, 2026 that it is handing security firm Hacktron wider access to its frontier models so Hacktron's researchers can probe OpenAI's own infrastructure for flaws, per OpenAI's announcement.

What

Under the partnership, Hacktron gets expanded access to OpenAI's models through Daybreak Red, a restricted cybersecurity-research tier, with engineers from both companies jointly picking which systems to test per OpenAI. Hacktron first came onto OpenAI's radar through OpenAI's own Security Bug Bounty program, where Hacktron's AI agents for code review, penetration testing, and red teaming had already turned up disclosed vulnerabilities. "The future of cybersecurity won't be defined by who has the largest security team, but by who can best combine human creativity with AI-driven capabilities," Hacktron CEO Zayne Zhang said in the same release. Neither company disclosed a dollar figure or contract length for the arrangement.

Third-party connections are the explicit test target

The joint testing is framed specifically around "how our systems interact with third-party services," not the models in isolation, per OpenAI's announcement. For a business running ChatGPT Enterprise, Codex, or API integrations that touch outside tools, that framing puts connectors and plugin surfaces on the same footing as core infrastructure. A vulnerability this partnership surfaces is therefore more likely to show up in how a product talks to a customer's own stack than in the model weights, which is exactly the integration risk a business should be auditing on its own side rather than assuming the vendor's red team already covers it.

Part of a broader hardening push

The Hacktron deal landed inside the same week OpenAI more than quadrupled the midpoint reward for medium, high, and critical bug-bounty findings; a critical vulnerability in ChatGPT, Codex, or the API Platform now pays up to $30,000 in base reward, and exceptional critical findings can reach $172,000 once bonus multipliers apply per OpenAI's bounty update. It also follows a security sprint where OpenAI dedicated 25% of its product engineers to finding and patching weaknesses with Codex, a model OpenAI is now extending to Daybreak customers through $1 billion in subsidized access over six months for frontline defenders per OpenAI. Stacked together, the three moves treat outside researchers as a standing layer of defense rather than a one-time audit.

What to watch next

Watch for Hacktron to publish a disclosed vulnerability from the partnership, and for OpenAI to extend Daybreak Red access to additional outside security vendors, which would signal the Hacktron arrangement is becoming a template rather than a one-off.

Sources