OpenAI Is Now Partnering With the Security Firm That Hacked It in July

In late July, a small security firm called Hacktron reported a chain of flaws that let it reach an OpenAI employee's Codex account. By Sept. 1, OpenAI had paid a $6,500 bounty and closed the report. On Nov. 6, the two announced a partnership.

It's an easy story to like, and it also answers a question people have been asking since GPT-6 Cyber launched: who gets to use it?

The Partnership

Hacktron says its researchers will work with OpenAI engineers to prioritize testing of connections between OpenAI's products and third-party services. In return, Hacktron gets broader access to OpenAI's frontier models through Daybreak Red, OpenAI's restricted offensive-security program. The announcement follows Hacktron's earlier work in OpenAI's bug bounty program.

HuggingNews reports that the deal came a day after OpenAI began rolling out GPT-6 Cyber to select Daybreak Red participants, including security teams at Mozilla, Palo Alto Networks and Cisco. HuggingNews describes the model as built for vulnerability discovery and red teaming within authorized targets, and quotes OpenAI saying on X that it's expanding access over time.

How They Met

Hacktron published its own account in September, and it reads like a heist. The chain started with a bug in the image-processing code of Discourse, the forum software behind community.openai.com. That gave the team code execution on the forum.

The forum lets people sign in with their OpenAI account. Hacktron says a flaw in that single sign-on setup meant a compromise of the forum could reach the ChatGPT and Codex accounts of anyone logging in. Hacktron says it took over an OpenAI employee's account whose Codex was connected to OpenAI's GitHub organization, then had it open a harmless pull request in an internal repository, and stopped there.

The timeline in the write-up is tight. Hacktron found the bug on July 23 and reported it through OpenAI's bug bounty on July 25. OpenAI confirmed a fix about 14 hours later. Discourse published its own advisory on July 28. OpenAI paid $6,500 and marked the report resolved on Sept. 1, noting that testing against the community forum had been explicitly excluded from the bounty's scope, so the award recognized the OpenAI-side finding and not the actions against Discourse.

Hacktron also says it used frontier models in the research, including Anthropic's Claude Opus 4.8 and Opus 5.

Our Take

The interesting part isn't the money. In Hacktron's case, at least, OpenAI is picking an early user who's already shown it can find real bugs in its own stack. That's a sensible filter. A researcher who's found a path from a forum to a company repo is exactly the kind of user you'd want pointing a vulnerability-hunting model at your products, and exactly the kind of user you'd worry about if you didn't know them.

It also shows how access to the strongest security models is likely to work for a while: invitation-only, relationship-driven, and run through a program with its own rules. That's good news for defenders who get in and a harder landscape for everyone else.

What We Cannot Conclude

• We don't know what Hacktron can use. The announcements say "broader frontier-model access" through Daybreak Red. They don't say whether GPT-6 Cyber is part of it.
• We don't know how Daybreak Red picks people. No selection criteria or terms have been published in the coverage we found.
• The July incident is Hacktron's account. We've seen OpenAI's confirmation of the fix timing and the bounty as quoted by Hacktron, but not a separate OpenAI write-up of what happened.
• There's no data on results yet. The partnership is days old.

Why It Matters

• Access to the best AI security tools is being rationed. Programs like Daybreak Red decide who can use them first.
• Bug bounty finders are becoming partners. The line between outside researcher and trusted insider is getting thinner.
• Third-party connections are the target. The first stated job is testing how OpenAI's products link out to other services, which is where the July chain ran.
• AI is on both sides of this. The same kind of model that finds bugs for defenders can be asked to find them for attackers. We covered that tension in our PHP2Shell guide.