On November 6, 2026, OpenAI announced on its official blog that the company had formally established a partnership with cybersecurity firm Hacktron. Engineers from both sides will jointly select high-priority testing targets, focusing on vulnerabilities in the connections between AI systems and third-party services. As part of the partnership, Hacktron gained access to OpenAI's frontier cybersecurity models through OpenAI's "Daybreak Red" program.
On July 25, 2026, Hacktron researchers submitted a report to OpenAI's bug bounty platform Bugcrowd, documenting an attack chain: in less than 72 hours, they went from OpenAI's community forum into the company's internal code repository.
The attack path was as follows: the researchers uploaded a carefully crafted HEIF image to OpenAI's Discourse forum. The forum's image-processing module relied on a version of libheif with a known vulnerability, triggering a heap overflow memory vulnerability and achieving remote code execution (RCE). After gaining a foothold, they found flaws in OpenAI's single sign-on (SSO) mechanism, using it to laterally pivot to multiple employees' ChatGPT and Codex accounts, and through GitHub permissions linked to Codex, accessed OpenAI's internal private code repositories.
To prove that the access was genuine and without reading sensitive code, the researchers used an employee's Codex account to submit a harmless pull request in the internal monorepo, then voluntarily stopped testing.
OpenAI confirmed and fixed the SSO issue about 14 hours after receiving the report; Discourse completed the forum-side patch two days after being notified. On September 1, 2026, OpenAI paid Hacktron a $6,500 bug bounty. On September 13, Hacktron publicly disclosed the full attack process. Hacktron used Anthropic's Claude as an auxiliary tool during the penetration.
From "Adversary" to "Ally": Behind the Partnership Logic
Hacktron is a company focused on AI-driven security tools, with main products including code review AI agents, penetration testing automation, and red team testing services. Its core competitiveness lies in integrating the reasoning capabilities of large language models into offensive security workflows.
Hacktron CEO Zayne Zhang said in the announcement: "The future of cybersecurity will not be determined by who has the largest security team, but by who can best combine human creativity with AI-driven capabilities." He added that OpenAI "has set a strong example by putting frontier cybersecurity models in the hands of security researchers."
Daybreak Red: Access Architecture
The Daybreak Red access that Hacktron received is a core component of OpenAI's tiered cybersecurity program, officially announced on August 10, 2026. Daybreak currently has two tiers:
- Blue tier: aimed at most defensive security teams, providing general-purpose frontier models with safeguards;
- Red tier: aimed at organizations authorized to conduct vulnerability research, exploit validation, and red team testing, providing specially trained cybersecurity models, including GPT-5.6-Cyber and subsequent GPT-6 Cyber versions.
Applying for Red tier access requires identity verification, account security review, use-restriction determination, and legal declarations. OpenAI giving Hacktron Red tier access means the latter will be able to use these models, specially trained for offensive and defensive scenarios, to find vulnerabilities in OpenAI itself.
In the same week as the partnership with Hacktron was announced, OpenAI also announced that researchers from Cathedral would join its next security sprint, while raising the maximum reward cap for its bug bounty program.
Where the Real Vulnerability Lies
Hacktron's intrusion case reveals a structural security dilemma of the AI era: The most dangerous attack surface is not the AI model itself, but the connections between AI systems and surrounding services.
The starting point of this attack was the forum's image-processing module, and the endpoint was the internal code repository. The stepping stone in between was SSO—a mechanism that was supposed to simplify access management but in practice bundled the permissions of all services together. Attackers do not need to directly breach GPT; they only need to find any third-party system with weaker boundaries operating around GPT.
This logic will be further amplified in the AI agent era. When AI agents are authorized to connect to calendars, email, code repositories, and CRM systems, every new integration link is a new potential entry point. OpenAI explicitly stated in the announcement that the focus of this partnership is precisely "testing the weaknesses that arise when AI agents connect services in new ways and using the findings to strengthen defenses."
Independent Judgment
Turning intruders into partners is standard practice in mature security systems. Google Project Zero, Microsoft MSRC, and Apple's Security Research Device Program have all taken this path to varying degrees. OpenAI's difference is that its core product is itself AI, and the tools it uses to strengthen security are also AI—attack and defense use the same technological foundation, which makes the arms race in this field logically more intense than in traditional software security.
Hacktron used Claude to breach OpenAI, and OpenAI armed Hacktron with GPT-6 Cyber to test itself in turn; this scenario looks like a paradox but is in fact the reality of AI security. Whoever can bring this capability into a controllable institutional framework and continuously iterate will hold the security initiative for the next stage.
© 2026 Winzheng.com 赢政天下 | 转载请注明来源并附原文链接