OpenAI Partners With Hacktron, the Team That Used Claude to Reach Its Internal Code

Under the arrangement announced on Friday, OpenAI said it is expanding Hacktron's access to its frontier models through Daybreak Red, and that OpenAI engineers and Hacktron researchers will jointly choose areas to test, focusing on how OpenAI's systems interact with third-party services. OpenAI said it first came across the firm through its bug bounty programme and was impressed by the impact of the vulnerabilities its researchers had found and disclosed.

The deal shows a leading AI developer turning to outside attackers to probe the seams between its own products and the services they plug into, the area where Hacktron's earlier break-in started. As AI agents link applications, identity systems and infrastructure in new ways, those connections are becoming a larger target. Hacktron builds AI agents for code review, penetration testing and red teaming.

Daybreak Red is the more restricted tier of the cybersecurity programme OpenAI announced on August 10. According to Unite.AI's account of that announcement, Red offers purpose-trained models for authorised vulnerability research, exploit validation and security testing, while a Blue tier offers general-purpose models with defensive safeguards and is recommended for most defenders. Access is limited to approved people and organisations doing authorised work, with identity checks, monitoring and legal attestations.

The Forum Break-In

Hacktron's route into OpenAI began outside the company. According to SecurityWeek's reporting in September, the researchers used Anthropic's Claude Opus 4.8 and Opus 5 models, over several attempts, to build a working exploit for a bug in the libheif image library, which OpenAI's community forum, run on Discourse software, reached through ImageMagick. Hacktron said the libheif bug had been fixed upstream a year earlier without being flagged as a security issue, so it never received a CVE and was missed in routine patching.

That gave the team code execution on the forum. Because the forum let people sign in with their OpenAI accounts, and its sign-in tokens carried excessive permissions, Hacktron could take over the ChatGPT and Codex accounts of people who logged in, including OpenAI staff. The researchers took over an employee account whose Codex integration was linked to OpenAI's GitHub organisation and opened a pull request in an internal repository before stopping, according to the reports. Hacktron said it chained the flaws on July 25, 2026, and described the work as not fully autonomous, saying skilled human guidance remained important.

OpenAI's review found limited reads of private repository metadata and commits, plus the pull request, which targeted a README file, SecurityWeek reported. OpenAI said it "narrowed the permissions on Community sign-in tokens and revoked affected tokens and sessions," confirming a fix about 14 hours after the report arrived through its Bugcrowd programme. Discourse had its own fix ready within two days and added sandboxing for image processing.

OpenAI paid Hacktron a $6,500 bounty on September 1 for the OpenAI-side finding. The award did not cover the testing of the Discourse-hosted forum, which fell outside the programme's scope.

The partnership arrives in the same week OpenAI said an unreleased model had found 948 Linux kernel flaws it could exploit for root access, as the company presses the case that frontier models are now strong enough to change how software is attacked and defended. OpenAI has not said how long the Hacktron arrangement will run or whether it will publish what the joint testing finds.