OpenAI teams with Hacktron to hunt vulnerabilities: security agents get frontier-model access, with third-party service links in focus

OpenAI and Hacktron have set up a vulnerability-finding partnership in which engineers and security researchers from both sides jointly choose high-priority areas to test, with emphasis on how OpenAI's systems interact with third-party services. Previously OpenAI reached independent researchers through its bug bounty program and had already raised bounty rewards to encourage finding vulnerabilities its own testing may have missed; this arrangement brings an outside security team into joint testing. OpenAI says it became familiar with Hacktron through its Security Bug Bounty program and was impressed by the impact of the vulnerabilities its researchers had discovered and disclosed.

The technical basis is the AI agents Hacktron builds for code review, penetration testing and red teaming, whose research has uncovered vulnerabilities in how applications, cloud infrastructure and identity systems interact. OpenAI pairs that agent capability with its own frontier models, expanding Hacktron's access to them through Daybreak Red so the connections between systems can be tested more deeply. The partnership follows OpenAI's announcement this week that Cathedral researchers will work alongside its teams in the next security sprint and that bug bounty rewards were raised, part of the same push to harden its own systems.

The announcement describes an arrangement: both sides jointly select high-priority areas to test, with emphasis on system interactions with third-party services, and Hacktron's access to frontier models is expanded through Daybreak Red; no testing timeline, coverage list or test result is given.

The announcement does not disclose which specific systems will be tested, how many vulnerabilities are found or how severe they are, nor the specific terms of the expanded model access; Hacktron's CEO statement expresses the partner's expectations rather than a verified effect.