OpenAI announced a partnership with Hacktron on Friday. The security firm will look for vulnerabilities in OpenAI’s own systems. Engineers from both sides pick the high-priority areas to test together, with the focus on how OpenAI’s systems interact with third-party services. OpenAI is also expanding Hacktron’s access to its frontier models through Daybreak Red.
The name will ring a bell. In July, three people from Hacktron got into OpenAI’s internal code repository, and their tool was Claude Opus 5. It started with a doctored image in the OpenAI forum. OpenAI now writes that it became familiar with Hacktron through its own bug bounty program and was impressed by the impact of what the firm’s researchers reported.
What Hacktron builds
The company builds AI agents for code review, penetration testing and red teaming. According to OpenAI, its findings cluster at the seams: how applications, cloud infrastructure and identity systems interact. That is also the focus of the new work, and it fits the moment. The more agents connect services to each other, the more attack surface appears between systems rather than inside them.
Zayne Zhang, Hacktron’s CEO, put it this way: “The future of cybersecurity won’t be defined by who has the largest security team, but by who can best combine human creativity with AI-driven capabilities.”
The third security announcement in a week
OpenAI announced two things on November 2: researchers from Cathedral will join its next security sprint, and bug bounty rewards are going up. On November 5 came 948 Linux exploits for $1.2 million, and the same day GPT-6 Cyber, rated “Critical” under OpenAI’s own Preparedness Framework. Hacktron makes four pieces in seven days.
Your own company is the hardest customer
What happens here is the most interesting development of the week for me, and not because of the partnership itself. OpenAI just shipped a model that finds attacks, and in the same breath hired an outside firm to check its own systems. Put together, that says the in-house tool is not enough to secure the in-house estate.
It is an honest admission, and it applies to anyone wiring agents into production systems. A model that finds holes finds them in the code you point it at. Who decides where to point it is someone who already has a hunch about where to look. That is the expertise OpenAI just bought — from the people who opened it up in the first place.