OpenAI and Hacktron target connected-service vulnerabilities | Magica
OpenAI taps Hacktron to test security across connected services
Editorial Team
••📖6 min read
OpenAI is expanding its relationship with Hacktron, whose researchers previously reported an attack chain into employee accounts, to test third-party connections with greater access to cybersecurity models.
OpenAI and Hacktron will jointly choose priority systems to test, focusing on third-party connections.
Earlier bug disclosures explain OpenAI's choice of Hacktron; the new arrangement has no disclosed findings yet.
Expanded cybersecurity-model access comes alongside higher bounty rewards and restrictions on authorized testing.
OpenAI, the developer of ChatGPT and the Codex coding agent, announced a partnership on November 6, 2026, with Hacktron to find vulnerabilities in its systems, focusing on connections to third-party services. Hacktron builds AI agents for code review, penetration testing and simulated attacks, and previously reported weaknesses to OpenAI through its bug bounty program.
OpenAI said in its announcement that its engineers and Hacktron researchers will select high-priority testing areas together. Hacktron will receive expanded access to OpenAI's frontier models through Daybreak Red, an access tier for approved researchers doing advanced cybersecurity work.
The immediate risk is that a weakness in one service can open a path into others through shared identities and connected accounts. Hacktron's earlier research illustrates that problem. It also shows that OpenAI is recruiting expertise in combining models with human investigation: the earlier attack chain relied in part on a rival provider's models.
Hacktron’s account of the research and response before the partnership. The bounty covered the OpenAI-side finding; the Discourse-hosted forum was outside OpenAI’s bounty scope. Graphic: Magica. Source: Hacktron.
Earlier findings explain the choice
OpenAI said it became familiar with Hacktron through its Security Bug Bounty program and was impressed by the impact of its disclosures. This expands an existing research relationship rather than introducing an untested outside team.
In its disclosure of the July research, Hacktron said it chained two critical vulnerabilities on July 25 to compromise multiple OpenAI employees' ChatGPT accounts. The chain joined code execution in a community forum hosted by Discourse, a forum-software provider, to an OpenAI single sign-on flaw. Shared sign-in then provided a route into ChatGPT and Codex, followed by a connected GitHub code-hosting integration. A also describes the chain, attributing the findings to Hacktron.
Internet scans and leaked databases expose the spread of ARTEX, a security-testing framework used in cyberattacks. Researchers documented largely autonomous compromises, but the records also show failed cashouts and uncertain counts of independent deployments.
The entry point was an image-processing dependency, not a flaw in a language model. Hacktron said security fixes to the libheif image decoder had not reached the package in Discourse's deployment. Its researchers then used Anthropic's Claude Opus 4.8 and Opus 5 models to develop the code-execution exploit. It also reported gains from OpenAI's GPT-5.6 Sol elsewhere in the broader research campaign. The prior success therefore does not establish that OpenAI's specialized cyber models were necessary for the work.
Hacktron said it demonstrated access by creating a harmless pull request in an internal repository, then stopped testing. It said OpenAI confirmed a fix about 14 hours after the report, Discourse had a fix ready two days after receiving its report, and OpenAI paid a $6,500 bounty on September 1. Its reproduced timeline also records OpenAI's qualification: the award covered the OpenAI-side finding; testing the Discourse-hosted forum had been explicitly outside the bounty's scope.
Hacktron also said it made its own Discourse Cloud test instance look like a capture-the-flag challenge because Claude refused to write exploits for remote instances. The disclosure supplies evidence of relevant experience, but also shows why authorization boundaries matter. A successful exploit chain and permission to test every system in that chain are separate questions.
Hacktron described the OpenAI and Discourse work as taking a few days of agent activity and a few hours of human time. Its figure of less than $3,000 in tokens covered a broader two-month research project by three researchers targeting Slack, Meta and other services. That is a model-usage cost for the campaign, not a full labor-cost accounting or the price of the new partnership.
OpenAI’s company-reported August request-completion rates measure responses, not successful exploitation or partnership effectiveness. Graphic: Magica. Source: OpenAI Daybreak announcement.
Specialized access has limits
Daybreak Red provides purpose-trained cybersecurity models for authorized vulnerability research, exploit validation and security testing. OpenAI's August 10 announcement introduced GPT-5.6-Cyber, designed to reduce refusals on some higher-risk tasks that can serve either attackers or defenders. It recommended Daybreak Blue, using general-purpose models for defensive work, as the starting point for most defenders.
On OpenAI's internal test of responses to advanced cybersecurity requests, GPT-5.6-Cyber completed 95% of requests, compared with 2% for GPT-5.6 Sol with Blue access. That measures willingness to respond, not successful exploitation.
Other company tests showed limits to specialization. In its August evaluation of vulnerability discovery and report writing, GPT-5.6-Cyber performed worse than GPT-5.6 Sol; OpenAI suggested sometimes shorter, less detailed reports explained the result. On ExploitBench, a controlled test of developing exploits for the V8 JavaScript engine, GPT-5.6 Sol with Blue access performed best and used tokens more efficiently at the standard 300-turn limit. Allowing 600 turns narrowed the gap. These are task-specific company evaluations, not measures of the Hacktron partnership.
The model lineup has since changed. On November 5, OpenAI introduced GPT-6 Cyber, a cybersecurity model trained to find and validate exploitable vulnerabilities and stay within researchers' specified scope. The next day's Hacktron announcement does not identify which model the team will use.
OpenAI's August access rules specify identity verification, account security, monitoring, approved-use restrictions and legal attestations. Its guidance calls for isolating security workflows from sensitive production systems and the open internet, reviewing agent actions outside the Codex sandbox before execution, and retaining human oversight for higher-risk work. Hacktron itself said the earlier research was not completely autonomous and required skilled human guidance.
OpenAI’s advertised core-product bounty ceilings are maximum awards, not typical payouts or Hacktron partnership fees. Graphic: Magica. Source: OpenAI bug bounty update.
Bounties broaden the research effort
On November 2, OpenAI announced higher bounty rewards: critical vulnerabilities in core products such as ChatGPT, Codex and its API platform can earn up to $30,000. Exceptional critical findings remain eligible for up to $100,000, rising to about $172,000 with bonuses. These are award ceilings, not typical payouts or the disclosed price of Hacktron's work.
The changes include bonuses for useful reports, repeat researchers and priority campaigns. OpenAI said it was more than quadrupling the midpoint of reward ranges for medium, high and critical findings on average. That is a change in advertised reward ranges, not evidence that actual payouts or researcher participation have quadrupled.
OpenAI also said an outside research team from Cathedral would work alongside its staff in its next security sprint. Its bounty update describes internal engineers already using models to find weaknesses, reproduce them and test fixes. Hacktron adds another research relationship to those existing approaches.
The next test is evidence of fixes
The announcement does not disclose partnership fees, a testing timetable, named third-party targets or a count of vulnerabilities found under the new arrangement. Its immediate commitment is joint prioritization and expanded model access.
The useful evidence to follow will be what the researchers find, which connected systems are affected, and whether fixes prevent a weakness in one service from carrying access into another. Until those results are disclosed, Hacktron's earlier work explains its selection; it does not measure the new partnership's effectiveness.
Meta's strategy chief and former CFO is joining Fireworks AI ahead of a reported fundraising push targeting at least a $30 billion valuation. The inference company announced a $17.5 billion valuation in July, making the hire part of a much larger expansion than its older funding figures suggest.
Sand.ai says its $200 million Series A+ round lifts its valuation above $1 billion. Co-lead investor Wangsu plans inference and deployment cooperation, while its filing shows substantial losses behind the startup’s video AI ambitions.
An advocacy group estimates Interior Secretary Doug Burgum’s AI holdings at $18.1 million–$64.4 million as his department advances data centers on public land. His ethics agreement allows retained investments with recusals, while pending permits will determine both the application of those safeguards and the public’s return. Interior denies his decisions are driven by personal investments.
Microsoft is evaluating fewer neocloud partners while expanding its own infrastructure. Delivery-dependent contracts underpin supplier financing, while IREN reports rising revenue alongside a $6 billion funding target for its broader expansion.
Physical Superintelligence says its AI system found a proof of a conjecture limiting quantum query advantages on random inputs. Public proof files enable scrutiny, but do not establish the private system’s cost or repeatability.
Google has acquired Crusoe’s southeast Wyoming data center site, where it plans a long-term $17 billion investment. Crusoe describes completed pre-development work; independent reporting points to customer setbacks. Power delivery and carbon capture remain key tests.
The team behind document-parsing service SoMark has released OXR-1.0 code and weights. A benchmark retest supports a strong result, but speed and accuracy were measured separately, and users above funding or revenue thresholds need a commercial license.
OpenAI is reportedly developing a Business Hub with daily mention and click charts, product updates and business agents. The unannounced feature could give verified businesses direct visibility into ChatGPT responses, without revealing prompts or competitor rankings.
Palantir and Nvidia have specified an integrated stack for running AI in customer-controlled environments. The architecture builds on existing software and infrastructure offerings, with published configurations spanning 32 to 640 GPUs, while pricing and workload economics remain unproven in the launch materials.
Democrats’ incoming congressional majorities put hearings and investigations within reach, but AI rules and crypto legislation still face bipartisan bargaining and a Republican president.
Microsoft reportedly declined to renew Oracle server rentals as older chips became less useful to it. The decision comes despite continuing capacity shortages, while Oracle says demand for earlier-generation GPUs remains strong.
An investigation puts Nvidia’s future commitments and guarantees at $530.5 billion. Its disclosures show rapidly expanding supplier commitments and phased support for customers whose infrastructure could generate further chip sales, with cash payments depending on timing, demand and contract terms.
TSMC is reportedly planning a possible move into 3D DRAM at Nvidia’s request. The foundry already helps integrate AI processors with memory, but a manufacturing expansion has no disclosed factory or production date.
Physicl has raised a $10 million seed round and introduced Studio, a beta app for generating targeted physical AI data. Its reported customer gains concern 3D reconstruction, leaving broader robot reliability and commercial economics to be demonstrated.
New cloud partners in Southeast Asia must enroll in Nvidia’s Fleet Intelligence system, according to a report, linking preferred chip access to monitoring while leaving data sharing and existing partners’ obligations unresolved.
Airbnb sold intellectual property to a private AI lab controlled by CEO Brian Chesky in a $7.1 million arrangement that also reimburses expenses. It obtained a license to certain lab technology and future investment rights, but disclosed no asset valuation or detailed license terms.
Chip shares recovered part of Thursday’s losses in early Friday trading. Fears about data-centre construction face a test against AI-chip supplier Nvidia’s strong reported sales, growth forecast and conditional infrastructure-financing plans.
SoftBank shares fell 10.8% as default-insurance costs reached a four-year high. Delayed listings and unfinished data centers complicate its AI investment outlook, while a $40 billion bridge facility has a March 2027 maturity and a repayment plan based on existing assets and other financing.
U.S. prosecutors allege a global fraud combined AI impersonation, sham confidential deals and cryptocurrency laundering. A blocked bank transfer shows why convincing an employee and moving the money are separate hurdles.
