OpenAI and Hacktron Test Connected-Service Security Weaknesses

By Amara Osei

OpenAI paid Hacktron a $6,500 bounty on September 1, 2026, after Hacktron researchers chained two critical vulnerabilities that compromised multiple employees’ ChatGPT accounts. The award recognized the OpenAI-side finding, not testing against an explicitly out-of-scope Discourse-hosted forum, according to Hacktron’s reproduced timeline.

What will OpenAI and Hacktron test?

OpenAI announced the partnership with Hacktron on November 6, 2026. The companies will test vulnerabilities in OpenAI’s systems, focus on connections with third-party services and expand Hacktron’s access to frontier models through Daybreak Red.

OpenAI engineers and Hacktron security researchers will jointly select high-priority areas to test. The work will examine how systems interact as AI agents connect services in new ways, then use the lessons to strengthen OpenAI’s defenses. OpenAI and Hacktron framed the target as weaknesses across linked applications, identity systems and infrastructure.

OpenAI said it learned about Hacktron through its Security Bug Bounty program. The company said it was impressed by the impact of vulnerabilities Hacktron researchers had discovered and disclosed.

How did the vulnerabilities reach connected systems?

In its September 13, 2026 account, Hacktron said its researchers chained two critical vulnerabilities on July 25, 2026. The chain compromised multiple OpenAI employees’ ChatGPT accounts and created potential access to internal repositories and other connected services, Hacktron said.

The chain combined remote code execution in the image-processing path of OpenAI’s Discourse-hosted community forum with an OpenAI single sign-on issue. Hacktron said the forum compromise crossed into ChatGPT and Codex, then reached a connected GitHub integration.

To prove access without reading sensitive internal code, Hacktron used an employee’s Codex account to create a harmless pull request in OpenAI’s internal monorepo. Hacktron then stopped testing, according to its account.

Hacktron reported the issues through OpenAI’s Bugcrowd program and directly to Discourse. Its timeline says OpenAI confirmed a fix roughly 14 hours after the initial report, while Discourse had a fix ready two days after receiving its report.

Why does Hacktron fit the test?

Hacktron builds AI agents for code review, penetration testing and red teaming. Its research has uncovered vulnerabilities in interactions among applications, cloud infrastructure and identity systems, capabilities that align directly with OpenAI’s connected-service test.

Hacktron’s July chain joined a forum flaw, an OpenAI sign-on issue and a connected GitHub integration. Hacktron’s account shows how one compromised service can provide a path into several others.

What do Daybreak Red and Blue provide?

OpenAI’s August 10, 2026 Daybreak announcement defines Red as access to “purpose-trained cybersecurity models” for authorized vulnerability research, exploit validation and security testing. The company recommends Blue as the starting point for most defenders.

Blue provides frontier general-purpose models with safeguards tailored to authorized defensive work, OpenAI said. Teams whose authorized work includes advanced vulnerability research, exploit development or red teaming can request Red access.

Access to both tiers is limited to approved individuals and organizations conducting authorized work. OpenAI’s controls include identity verification, account security, monitoring, approved-use restrictions and legal attestations.

OpenAI’s documented best practices call for:

• Isolating security workflows from sensitive production systems and the open internet.
• Reviewing agent actions outside the Codex sandbox before execution.
• Adding human oversight for higher-risk workflows.
• Using scoped permission profiles to enforce authorized boundaries.

Where does human oversight remain necessary?\n

Hacktron’s earlier account said the work was “not completely autonomous” and that skilled human guidance remained important. Hacktron’s account frames the partnership’s defensive value as a balance between expanded access to cyber-capable models for deeper testing and enforceable scope, monitoring and human oversight when agents are used.

The next test for OpenAI and Hacktron is whether broader model access can expose cross-service weaknesses while identity checks, monitoring and human review keep agents inside authorized boundaries.