OpenAI is paying Hacktron, the security startup that broke into employee ChatGPT accounts this summer, to hunt for more flaws in the company’s own systems. The partnership announcement landed on November 6, according to most reports, although some outlets date it to November 7. The OpenAI Hacktron partnership turns a hostile test into a paid one, and it offers a clear case study in how one weak link can reach an entire set of accounts.
What OpenAI and Hacktron agreed to
OpenAI engineers and Hacktron’s researchers will choose high-priority areas to test together. The focus is on how OpenAI’s systems interact with third-party services. Hacktron’s access to OpenAI’s frontier models is also expanding through Daybreak Red, the highest tier of OpenAI’s cybersecurity program. TechCrunch reports that Daybreak Red gives offensive security researchers tools for vulnerability hunting and development, and that OpenAI made its cyber-focused model available there.
Hacktron builds AI agents for code review, penetration testing and red teaming. Its research has uncovered weaknesses in how applications, cloud infrastructure and identity systems interact. OpenAI said it first came across the firm through its Security Bug Bounty program. The company found Hacktron through its public flaw-reporting channel before it decided to hire the team.
How Hacktron chained two flaws into staff accounts
According to NBC’s reporting, the chain began with an image upload to OpenAI’s community forum, which ran on Discourse, a third-party forum platform. The researchers combined two unknown vulnerabilities: one in Discourse and one in how OpenAI validates its employees. Together, they reached the ChatGPT accounts of several OpenAI staff members.
Hacktron dates the access to July 25, 2026, in a write-up on its blog. The team said the access could have reached internal OpenAI repositories and potentially many other connectors. On X, the company posted: “On July 25, our team hacked OpenAI.” That line is Hacktron’s own claim, and the technical write-up is the main evidence behind it.
Which AI model did the work is less clear. A Hacker News headline credits Anthropic’s Claude Opus 5 with helping the researchers chain the flaws. AI Weekly reports the opposite, quoting the researchers as saying “Opus 4.8 struggled across several sessions to produce a working exploit.” The two accounts conflict, and no independent audit has settled the question.
How much access the researchers actually claimed
Hacktron says its proof of access was narrow. When one employee’s Codex link to OpenAI’s code on GitHub was opened, it triggered a single pull request in an internal repository. The team says it did not read source code, merge or ship anything, or touch customer data.
OpenAI paid Hacktron a $6,500 bounty on September 1, 2026, according to Hacktron’s timeline as reproduced by Unite.ai. An OpenAI spokesperson confirmed Hacktron’s report and said the vulnerabilities have since been patched. Hacktron also says OpenAI fixed the single sign-on issue roughly 14 hours after the report, and that its own chain took less than 72 hours. Those timing claims come from Hacktron and have not been independently confirmed.
The key dates are below.
| Date | Event |
|---|---|
| July 25, 2026 | Hacktron says it gains access to employee ChatGPT accounts |
| September 1, 2026 | OpenAI pays a $6,500 bounty, per Hacktron’s timeline |
| September 13, 2026 | Hacktron publishes its account |
| September 19, 2026 | Hacker News covers the research |
| November 6, 2026 | OpenAI announces the Hacktron partnership |
The scope remains unclear. OpenAI has not said how many employee accounts were affected or whether any non-employee accounts were exposed.
Why connected accounts raise the stakes
The write-up argues that the risk reached past ChatGPT itself. Because staff connect other services to ChatGPT and Codex, the team said the same access could in theory have extended to tools such as GitHub, Slack and email. A researcher quoted by NBC said the chain resembled methods that “very high-level real-world attackers, such as APTs or nation-state-backed hackers, would use to compromise targets.”
For everyday users, the lesson concerns the connections around an account, not just the chat history. Anyone who signs into ChatGPT or Codex through single sign-on and has linked those accounts to email, cloud storage, GitHub or Slack faces the same kind of exposure. For IT and security teams, the takeaway is that a bug in a side service, in this case a community forum, can reach identity and then everything attached to it.
Attackers are using AI agents too. A China-linked group used AI agents to probe more than 200 organizations, which shows the same class of tools is being used on both offense and defense.
How to check your ChatGPT and Codex accounts
The following steps are analyst recommendations, not advice from OpenAI or Hacktron. Each one takes only a few minutes.
- Review every app and integration connected to your ChatGPT and Codex accounts, and remove any you no longer use.
- Turn on multi-factor authentication for ChatGPT, Codex and any developer account they connect to.
- Check which services sign in through your single sign-on provider, and cut access you do not need.
- For teams, audit SSO-linked AI accounts that can reach code repositories, and limit which ones can open internal GitHub links or connectors.
What to watch as the partnership begins
The terms are not public. Sources do not say whether the arrangement is paid, how long it runs, or which high-priority areas the teams picked. Those details will show how much weight OpenAI places on outside testing compared with its internal security staff.
Three things are worth tracking. First, whether OpenAI publishes the number of affected employee accounts, which it has not yet done. Second, whether an independent technical reviewer confirms Hacktron’s timeline and the 14-hour fix claim. Third, whether the partnership produces disclosed findings about third-party integrations, the area both companies said they will focus on.
Automated probing is spreading into older security systems as well. Google DeepMind’s AI agents exposed two weaknesses in 1024-bit RSA, a result that points to the same kind of machine-driven testing reaching cryptography, not only chat accounts. OpenAI is betting that paying the people who broke in will surface the next weakness before an attacker does. The proof will be whether its next disclosure is as specific as Hacktron’s first one.
