OpenAI Partners with Hacktron to Test Third-Party Service Boundaries in AI Agent Systems
The collaboration expands Hacktron’s frontier-model access via Daybreak Red while targeting how OpenAI systems connect to external services as AI agents proliferate.
Published
Last updated / Fact-checked on
Illustrative photo of a server rack and network cabling — not OpenAI, Hacktron, or any systems described in this article. Photo by Tho-Ge (Thomas G.) on Pixabay — Pixabay Content License
OpenAI announced a partnership with Hacktron on November 6, 2026, to find vulnerabilities in its systems, according to a post on OpenAI’s website. OpenAI said its engineers and Hacktron’s security researchers will choose high-priority areas to test together, with a focus on how OpenAI systems interact with third-party services. The company linked that focus to AI agents connecting services in new ways and said deeper testing of those connections will help strengthen its defenses.
As part of the partnership, OpenAI is expanding Hacktron’s access to its frontier models through Daybreak Red, according to both OpenAI’s announcement and Hacktron’s matching November 6 post. OpenAI said it became familiar with Hacktron through its Security Bug Bounty program and was impressed by vulnerabilities Hacktron’s researchers discovered and disclosed. OpenAI described Hacktron as building AI agents for code review, penetration testing, and red teaming, and wrote that Hacktron’s research has uncovered vulnerabilities in how applications, cloud infrastructure, and identity systems interact.
At a glance
| Item | Detail | Source |
|---|---|---|
| Announcement date | November 6, 2026 | OpenAI; Hacktron |
| Focus | OpenAI systems’ interactions with third-party services | OpenAI; Hacktron |
| Model access | Expanded frontier-model access via Daybreak Red | OpenAI; Hacktron |
| Prior relationship | OpenAI Security Bug Bounty program | OpenAI; Hacktron |
| Same-week OpenAI steps | Cathedral researchers in next security sprint; bug-bounty rewards raised (no amounts) | OpenAI |
| Hacktron description | AI agents for code review, penetration testing, and red teaming | OpenAI |
Partnership details
Hacktron’s November 6 post confirmed the same scope: researchers will work with OpenAI engineers to prioritize testing of third-party connections, with broader frontier-model access through Daybreak Red. Hacktron said the collaboration follows its work in OpenAI’s security bug bounty program.
Zayne Zhang, CEO of Hacktron, is quoted on both companies’ posts: “The future of cybersecurity won’t be defined by who has the largest security team, but by who can best combine human creativity with AI-driven capabilities. OpenAI is setting a strong example by putting frontier cyber models in the hands of security researchers, enabling them to uncover complex vulnerabilities at the boundaries between interconnected systems. We’re excited to deepen our partnership with OpenAI, combining our offensive security expertise with their frontier models to help secure OpenAI and the broader software ecosystem.”
In the same November 6 post, OpenAI said that earlier that week it announced Cathedral’s researchers will work alongside its teams in its next security sprint, and that it raised bug-bounty rewards. Neither company stated a partnership price, duration, exclusivity, reward amounts, or any new vulnerability found under the collaboration.
Prior finding as context
OpenAI’s November 6 announcement does not restate Hacktron’s earlier case study, but that history helps explain the third-party focus.
According to Hacktron’s September 13, 2026, post “Hacking OpenAI,” on July 25, 2026, researchers chained issues involving OpenAI’s Discourse-hosted community forum and an OpenAI sign-in path that could take over ChatGPT and Codex accounts, including employee accounts. To demonstrate access without reading sensitive internal code, Hacktron said it used an employee’s Codex account to open a harmless pull request in an internal OpenAI monorepo, then stopped testing. Hacktron reported through Bugcrowd; OpenAI confirmed a fix about 14 hours later; and on September 1, 2026, OpenAI paid a $6,500 bounty for the OpenAI-side finding, per Hacktron’s timeline. OpenAI’s comment there said Discourse forum testing was outside bounty scope.
SecurityWeek reported that OpenAI distinguished the Discourse image-processing issue from a separate OpenAI-side account-access path and said it narrowed Community sign-in token permissions and revoked affected sessions.
What to watch
Readers who build or rely on AI agents that connect external services should note the explicit focus on those seams. Daybreak Red is described only as expanded frontier-model access for Hacktron.
More coverage is on our Artificial Intelligence hub.
How we reported this
Based on OpenAI’s and Hacktron’s November 6, 2026, partnership posts, read directly. July 25 background from Hacktron’s September 13, 2026, “Hacking OpenAI” disclosure and SecurityWeek. Commercial terms, new partnership findings, and Daybreak Red internals beyond the source language were omitted because the posts do not state them.
Published and fact-checked November 6, 2026.
Sources
- OpenAI, “Partnering with Hacktron to find vulnerabilities in OpenAI’s systems,” November 6, 2026. https://openai.com/index/partnering-with-hacktron/
- Hacktron, “Partnering with OpenAI,” November 6, 2026. https://www.hacktron.ai/blog/openai-partnership
- Hacktron, “Hacking OpenAI,” September 13, 2026. https://www.hacktron.ai/blog/hacking-openai
- SecurityWeek, “AI-Built Exploit and Sign-In Flaw Opened Path to Internal OpenAI Code,” September 18, 2026. https://www.securityweek.com/ai-built-exploit-and-sign-in-flaw-opened-path-to-internal-openai-code/
DailyMech used AI tools to help research and draft this article; it was fact-checked by our editors.