Little more than three months after Hacktron’s researchers chained a bug in OpenAI’s community forum with a flaw in the company’s single sign-on to take over ChatGPT and Codex accounts, OpenAI has signed the security firm up to look for more holes, this time as a partner.
OpenAI said on Friday that its engineers and Hacktron’s researchers will choose high-priority areas to test together, “with a focus on how our systems interact with third-party services.” As part of the deal, Hacktron gets expanded access to OpenAI’s frontier models through Daybreak Red. OpenAI said it got to know the team through its Security Bug Bounty program and described it as a group that builds AI agents for code review, penetration testing and red teaming. “As AI agents connect services in new ways, that combination of skills becomes even more valuable,” the company wrote.
Hacktron CEO Zayne Zhang, in a statement OpenAI included and Hacktron posted on its own blog, said the company is “excited to deepen our partnership with OpenAI, combining our offensive security expertise with their frontier models to help secure OpenAI and the broader software ecosystem.”
What Hacktron found in July
Hacktron’s September write-up, “Hacking OpenAI,” explains why OpenAI wants that focus. On July 25, the researchers got code execution on community.openai.com, the Discourse forum OpenAI uses with “Sign in with OpenAI,” through a heap overflow in the libheif image library. Discourse passed HEIC and HEIF uploads to ImageMagick, which exposed the parser to attacker-supplied files. An SSO issue then let them take over the ChatGPT and Codex accounts of active forum members without any interaction from those users. With the account of an OpenAI employee whose Codex was connected to the company’s GitHub organization, they had Codex open a harmless pull request in OpenAI’s internal monorepo and stopped testing. WebProNews covered that research when it came out.
“The escalation bug is not specific to Discourse,” the researchers wrote. In their account, any compromised first-party or third-party service using OpenAI’s SSO would have led to the same access, and because people connect services such as GitHub, Slack and email to Codex and ChatGPT, the theoretical reach was large. Hacktron said OpenAI confirmed a fix about 14 hours after the report and later paid a $6,500 bounty. OpenAI’s comment on the report, which Hacktron reproduced, said testing against the Discourse-hosted forum was excluded from the program and that the award covered the OpenAI-side finding.
Hacktron also put numbers on the effort. It said the Discourse and OpenAI work “took a few days for an agent, and just a few hours of human time,” and that its wider HEIF Heist project, which also went after Slack, Meta and other targets, took three researchers two months and less than $3,000 in tokens. The team said Claude Opus 4.8 struggled to produce a reliable exploit with ASLR enabled, while Claude Opus 5 managed it within hours of its release. Its advice for anyone processing user-uploaded images is to install patched libheif and libde265 packages and to either disable untrusted HEIF and AVIF decoding or run image processing in hardened, short-lived sandboxes.
Bigger bounties, gated models
The partnership lands days after OpenAI raised its bug bounty payouts on Monday. The company said it is more than quadrupling, on average, the midpoint of its reward ranges for medium, high and critical findings. A critical vulnerability in ChatGPT, Codex or the API Platform can now earn up to $30,000, and exceptional critical findings remain eligible for up to $100,000, or up to $172,000 with new quality, loyalty and campaign bonuses. In OpenAI’s own illustrative table, a zero-click ChatGPT account takeover that historically drew $6,500 would pay $51,577 under the new formula.
Daybreak Red is the more restricted tier of Daybreak, OpenAI’s Trusted Access for Cyber program. Its help center page says Red organizations get GPT-5.6 Cyber, with GPT-6 Cyber available only with separate approval, for authorized penetration testing, red teaming, exploit validation and controlled vulnerability research. Individuals can’t apply for Red, which is limited to approved business and enterprise organizations, and OpenAI says approval is not automatic.
OpenAI’s security team plans to be at the PROMPT2PWN event in Oakland on Nov. 20-21, where the company said researchers can test targets in person.
WebProNews is an iEntry Publication