SafetyRisk, alignment & guardrails
OpenAI partners with Hacktron, the firm that took over OpenAI staff accounts through its community forum
OpenAI is partnering with Hacktron, whose researchers chained a Discourse forum exploit with an over-scoped SSO token to take over OpenAI employees' ChatGPT and Codex accounts. The two will jointly test OpenAI's third-party integrations, and Hacktron gains broader access to Daybreak Red cyber models.
From the OpenAI News article of November 6, 2026 and cited sources: On November 6, 2026, OpenAI announced that its engineers and Hacktron researchers will choose high-priority areas to test together, with a focus on how OpenAI's systems connect to third-party services. [1] [6] [4]
SOURCES[1] OpenAI: Partnering with Hacktron openai.com[6] Hacktron: Partnering with OpenAI hacktron.ai[4] Unite.AI unite.ai
AT Pulse research deskPublished · Updated · 5 min read · AI-assisted analysisAI-assisted, not human-edited. Methodology Corrections Who owns this site
- What happened
- On November 6, 2026, OpenAI announced that its engineers and Hacktron researchers will choose high-priority areas to test together, with a focus on how OpenAI's systems connect to third-party services. [1] [6] [4]
- Original source
- OpenAI News article, company source
- Brief by
- AT Pulse research desk AI-assisted; publisher and contact on the desk page
- When
- November 6, 2026 article published
- Covered
- Nov 7 edition
- Evidence
- 9 sources across 9 sites
RisingHow it’s measured
Hacker News · 10 likes · 2 comments
Reach blends public engagement (views, likes, comments, shares, stars) from the platforms where the story or its original source lives: YouTube, Hacker News, GitHub, Substack and similar. A video and the article written from its transcript share one score, taken from the video. Platforms with no data are left out rather than counted as zero, and the age of a story never lowers its score.
On November 6, 2026, OpenAI announced that its engineers and Hacktron researchers will choose high-priority areas to test together, with a focus on how OpenAI's systems connect to third-party services. The relationship began in OpenAI's Security Bug Bounty program. As part of the deal, Hacktron gets wider access to OpenAI's restricted Daybreak Red cyber models. [1] [6] [4]
The attack chained two flaws. First, a malformed HEIC image caused a heap overflow in libheif, which Discourse reaches through ImageMagick, and this gave remote code execution on OpenAI's forum. Second, the forum's sign-on tokens had full API access to linked ChatGPT and Codex accounts, and through Codex to GitHub. The bug was reported on July 25, 2026. OpenAI confirmed a fix about 14 hours later, narrowed the token permissions, revoked affected sessions and paid a $6,500 bounty. [8] [3] [4]
Hacktron says Anthropic's Claude Opus 4.8 found the libheif bug and built a partial exploit, and Claude Opus 5 then adapted it to Discourse's setup. Humans directed the work and made the key decisions. Hacktron also says it went from the forum to OpenAI's internal code in under 72 hours. Both the AI role and the timing come only from Hacktron's own account. [3] [8]
Daybreak Red is limited to authorized vulnerability research and exploit testing. Access requires identity verification, account monitoring, limits on approved uses, legal attestations and, from September, sign-in with hardware security keys. Its first model, GPT-5.6-Cyber, was trained specifically for exploit work and is built on GPT-5.6 Sol. [2] [4] [7]
OpenAI's bounty payment and fixes confirm the flaws were real. The likely lesson is that small weaknesses in side services such as forums, SSO and OAuth-linked apps can combine to reach source code, and AI help may shorten the time attackers need.
Enough sources are in hand to write the dossier now.
Executive brief
OpenAI's new security partner is the firm that broke into it. On July 25, 2026, Hacktron researchers chained a flaw in OpenAI's community forum with a single sign-on (SSO) flaw and took over OpenAI employees' ChatGPT and Codex accounts. One of those accounts was linked to OpenAI's GitHub. Hacktron says Anthropic's Claude models helped build the exploit. On November 6, OpenAI announced a partnership with Hacktron. The two will test how OpenAI's systems connect to third-party services, and Hacktron gets wider access to OpenAI's restricted cyber models through "Daybreak Red." The message for defenders: AI-assisted attackers can now get through the seams between services within days.
What changed and event timeline
Daybreak launches
OpenAI starts giving defenders access to unreleased frontier models for security work. This is the program the Hacktron deal later runs through ().
OpenAI employee accounts compromised
Hacktron goes from an image-parser heap overflow to code execution on OpenAI's Discourse forum, then to an SSO flaw and employee account takeover. Hacktron says it took under 72 hours.
More detail
It reported the bug via Bugcrowd, and OpenAI confirmed a fix about 14 hours later ().
Daybreak Blue and Red tiers
OpenAI adds two access tiers. Red is powered by GPT-5.6-Cyber, a purpose-trained model for exploit work ().
Bounty paid and details published
OpenAI pays a $6,500 bounty. Hacktron publishes technical details from September 13, and trade press picks up the story (;).
Partnership announced
OpenAI engineers and Hacktron researchers will pick high-priority areas to test together, focused on third-party integrations (;).
Capabilities and access
- Daybreak Red: purpose-trained cyber models for authorized vulnerability research, exploit validation and security testing.
- First Red model: GPT-5.6-Cyber, built on GPT-5.6 Sol (SiliconANGLE).
- Daybreak Blue: general frontier models with safeguards for defensive work, recommended as the starting tier for most defenders (Cyber Magazine).
Read the full section
- Daybreak Red: purpose-trained cyber models for authorized vulnerability research, exploit validation and security testing. Access requires identity verification, account monitoring, approved-use limits and legal attestations (Unite.AI). From September, participants must also sign in with hardware security keys (SiliconANGLE).
- First Red model: GPT-5.6-Cyber, built on GPT-5.6 Sol (SiliconANGLE).
- Daybreak Blue: general frontier models with safeguards for defensive work, recommended as the starting tier for most defenders (Cyber Magazine).
- The reviewed sources do not say which specific models Hacktron will use under the partnership.
Technical analysis for researchers and developers
- The exploit chain: Discourse screens most images with FastImage, but it hands HEIF files to ImageMagick, which decodes them with libheif.
- The SSO flaw: sign-in tokens for the forum carried too many permissions.
- What the AI did: Claude Opus 4.8 found the libheif bug and built a partial exploit. Claude Opus 5 then adapted it to Discourse.
Read the full section
- The exploit chain: Discourse screens most images with FastImage, but it hands HEIF files to ImageMagick, which decodes them with libheif. A malformed HEIC image triggered a libheif heap overflow. The exploit was adapted to Discourse's x86-64/jemalloc setup to get remote code execution (AI Weekly).
- The SSO flaw: sign-in tokens for the forum carried too many permissions. They gave full API access to the linked ChatGPT and Codex accounts, and through Codex to GitHub (AI Weekly).
- What the AI did: Claude Opus 4.8 found the libheif bug and built a partial exploit. Claude Opus 5 then adapted it to Discourse. Humans still guided the work and made the key decisions (Crypto Breaking).
- Reproducibility: none of the reviewed sources gives a CVE identifier.
Claims and evidence
- Under 72 hours, from forum to internal code: this is Hacktron's own claim. The speed claim has no outside confirmation.
- GPT-5.6-Cyber completed 95% of requests on OpenAI's internal benchmark, against 1.5% for GPT-5.6 Sol: these are OpenAI's own figures on its own benchmark (SiliconANGLE).
- The partnership will find more vulnerabilities: this is stated intent only. No results have been published yet (Hacktron).
Read the full section
- Under 72 hours, from forum to internal code: this is Hacktron's own claim. Hacktron says it proved access with a pull request in OpenAI's internal codebase (AI Weekly). OpenAI's bounty payment and fixes confirm that the bug was real (Unite.AI). The speed claim has no outside confirmation.
- GPT-5.6-Cyber completed 95% of requests on OpenAI's internal benchmark, against 1.5% for GPT-5.6 Sol: these are OpenAI's own figures on its own benchmark (SiliconANGLE). On the ExploitGym2 benchmark, the two models were reported as roughly equal.
- The partnership will find more vulnerabilities: this is stated intent only. No results have been published yet (Hacktron).
Context and prior work
Read the full section
- The partnership grew out of OpenAI's Security Bug Bounty program, which is how OpenAI came to know Hacktron's work (Unite.AI).
- Hacktron builds AI agents for code review, penetration testing and red teaming (Hyper.ai).
- OpenAI also uses its cyber models to hunt bugs itself. It reports finding two high-severity Chrome bugs and three critical bugs in an unnamed database (SiliconANGLE).
Limitations, safety and contested findings
- Scope: OpenAI's bounty covered only the OpenAI-side flaw.
- How long users were exposed: The Stack reports that any user or employee who logged into the forum could have had their accounts taken over until about two months before its September article (The Stack).
- Fix: OpenAI narrowed community-token permissions and revoked the affected tokens and sessions (AI Weekly).
Read the full section
- Scope: OpenAI's bounty covered only the OpenAI-side flaw. Testing the Discourse forum fell outside the program's scope, and Discourse shipped its own patch on July 27 (Crypto Breaking).
- How long users were exposed: The Stack reports that any user or employee who logged into the forum could have had their accounts taken over until about two months before its September article (The Stack).
- Fix: OpenAI narrowed community-token permissions and revoked the affected tokens and sessions (AI Weekly).
- Dual use: OpenAI itself treats Red-tier models as risky enough to gate behind verification and monitoring (Cyber Magazine).
Business and practitioner implications
- Watch the seams: the forum and SSO flaws were each modest, but together they reached source code.
- Harden image pipelines: libheif sits behind ImageMagick in many upload stacks.
- Bounty programs as hiring channels: a strong bounty submission turned into a strategic partnership, so expect more labs to recruit offensive firms this way.
Read the full section
- Watch the seams: the forum and SSO flaws were each modest, but together they reached source code. Check token scopes on peripheral services such as forums, help desks and OAuth-linked apps.
- Harden image pipelines: libheif sits behind ImageMagick in many upload stacks.
- Bounty programs as hiring channels: a strong bounty submission turned into a strategic partnership, so expect more labs to recruit offensive firms this way.
- Gated model access: offensive-capable models now require hardware keys and attestations, so buyers should plan for the compliance overhead.