OpenAI partners with Hacktron to test system vulnerabilities

A new security partnership

OpenAI announced on November 6 that it is partnering with Hacktron to identify vulnerabilities within its own systems. The company plans to have its engineers work alongside Hacktron's security researchers to target high-priority areas. This collaboration is specifically looking at how OpenAI's systems interact with third-party services.

The company first became familiar with Hacktron through its Security Bug Bounty program. This program allows independent researchers to find and report bugs in exchange for rewards. Hacktron is a firm that specializes in building AI agents designed for penetration testing, code review, and red teaming.

Red teaming is a security practice where professionals simulate attacks to find weaknesses in a system. By using a specialized firm like Hacktron, OpenAI aims to find flaws that might be missed by internal teams alone. This move highlights a growing trend of using external experts to stress-test frontier AI models.

Expanding model access

As part of this partnership, OpenAI is expanding Hacktron's access to its frontier models through Daybreak Red. While the specific models involved were not named, the expansion allows the security firm to perform deeper testing. This access is a key component of the company's strategy to secure its most advanced technologies.

Hacktron CEO Zayne Zhang noted that the partnership allows researchers to uncover complex vulnerabilities at the boundaries between interconnected systems. He stated that the future of cybersecurity will be defined by combining human creativity with AI-driven capabilities. This suggests a shift toward using AI to defend against other AI-driven threats.

The move follows a timeline of increased security activity from OpenAI. The company's news feed shows it made three security-related posts between November 2 and November 6. These included a security sprint with Cathedral and an announcement regarding larger bug bounties.

Focusing on interconnected risks

OpenAI explained that the focus on third-party services is necessary because AI agents are connecting services in new ways. When an AI model can interact with external software, it creates new pathways for potential exploits. The combination of skills held by Hacktron becomes more valuable as these connections become more common.

The partnership aims to address the risks that emerge when AI systems are not isolated. By testing these boundaries, researchers can see how a vulnerability in one service might affect the AI model or vice versa. This is a critical step for companies looking to deploy AI agents that can perform real-world tasks.

The collaboration represents a decision regarding who gets access to frontier intelligence and for what purposes. It functions as a permission layer where OpenAI decides which partners can interact with its most powerful models. This ensures that high-level testing is conducted by trusted entities with the right expertise.

Context and next steps

This announcement comes shortly after OpenAI shared figures regarding its cyber model's performance on the ExploitGym benchmark. It also follows reports on the pricing of its GPT-6 Cyber model. These updates show a broader effort to position OpenAI's models as tools for both security research and enterprise use.

While the specific terms of the Hacktron partnership were not disclosed, the expansion of Daybreak Red access is a significant move for security researchers. It provides a structured way for experts to test the limits of frontier models. The partnership will likely result in more rigorous testing of how AI interacts with the broader internet and corporate infrastructure.

Moving forward, the industry will watch how these partnerships evolve as AI agents become more autonomous. As models gain the ability to use tools and access data, the security of those connections will be a primary concern. OpenAI's proactive approach with Hacktron sets a precedent for how other labs might secure their frontier systems.