OpenAI has signed a formal testing partnership with Hacktron, the small offensive security firm whose researchers first came to its attention through its public bug bounty programme. OpenAI announced the deal on 6 November 2026, saying its engineers and Hacktron's researchers will choose the areas to test together, starting with how its systems connect to third-party services.

As part of the partnership, Hacktron gets wider access to OpenAI's most capable models through Daybreak Red, the company's restricted programme for offensive security work. Hacktron builds AI agents for code review, penetration testing and red teaming, and OpenAI said it was impressed by the impact of the vulnerabilities the firm's researchers had discovered and disclosed.

From a $6,500 bounty to a standing partnership

The relationship began in July, when Hacktron researchers chained two previously unknown flaws to reach OpenAI employees' ChatGPT accounts. One flaw was in Discourse, the third-party forum software OpenAI uses, and the other was in how OpenAI verified its staff. The work took under 72 hours and caused no damage. OpenAI confirmed the issues had been patched about 14 hours after the report and paid a $6,500 bounty on 1 September.

Hacktron chief executive Zayne Zhang said the company was excited to deepen the partnership, combining its offensive security expertise with OpenAI's frontier models to help secure OpenAI and the wider software ecosystem. The deal lands in the same week OpenAI raised its bug bounty payouts, with top rewards reaching up to $172,000 with bonuses, and brought Cathedral's researchers into its next security sprint.