OpenAI and Hacktron Team Up to Hunt Vulnerabilities

OpenAI is inviting more expert eyes onto its own infrastructure. On November 6, the company announced a partnership with Hacktron, a security firm that builds AI agents for code review, penetration testing and red teaming. Engineers from both teams will choose high-priority areas to test together, with a special focus on how OpenAI's systems interact with third-party services.

• OpenAI and Hacktron will jointly pick high-priority systems to test for vulnerabilities
• The work focuses on the connections between OpenAI's systems and third-party services
• OpenAI is expanding Hacktron's access to its frontier models through Daybreak Red
• OpenAI says it first got to know Hacktron through findings submitted to its Security Bug Bounty program

What Is the OpenAI and Hacktron Partnership?

It is a collaborative security engagement rather than a one-off audit. OpenAI says its engineers and Hacktron's researchers will work side by side on chosen targets. As part of the deal, Hacktron gets wider access to OpenAI's frontier models through Daybreak Red, the company's offensive security tier for vetted defenders.

The relationship grew out of responsible disclosure. OpenAI says it was impressed by the impact of vulnerabilities Hacktron's researchers found and reported through its bug bounty program. Hacktron's published research has uncovered issues in how applications, cloud infrastructure and identity systems interact, which is exactly the kind of seam OpenAI now wants to probe more deeply.

Why Focus on Third-Party Integrations?

As AI agents connect services in new ways, the most interesting security questions live at the boundaries. An agent that can read a calendar, call an API and write to a database creates trust relationships that no single system owner fully sees. OpenAI says combining human security engineering with AI tooling helps test those connections more deeply, and that it will feed what it learns back into its defenses.

Hacktron CEO Zayne Zhang framed it well, saying the future of cybersecurity will be defined by "who can best combine human creativity with AI-driven capabilities."

How Does This Fit OpenAI's Security Push?

This is the latest in a busy stretch of defensive moves. Earlier in the same week, OpenAI said researchers from Cathedral would join its next internal security sprint, and it raised its bug bounty rewards to encourage independent researchers. We covered that change in our look at the OpenAI bug bounty's $172,000 top payout.

For security teams, the lesson is practical. If your organization is wiring AI agents into SaaS tools, put integrations, tokens and identity flows at the top of your next red team scope, and give outside researchers a clear path to report what they find. For more defensive strategies, visit our AI security hub.

Sources: OpenAI: Partnering with Hacktron to find vulnerabilities in OpenAI's systems — November 6, 2026; Hacktron — accessed November 8, 2026.