Hacktron gets Daybreak Red access to hunt OpenAI’s bugs

OpenAI has brought in the AI security startup Hacktron to look for vulnerabilities in its own systems, with testing focused on how those systems interact with third-party services, OpenAI said in a November 6 post. Hacktron also gets wider access to OpenAI’s frontier models through Daybreak Red, and the public Security Bug Bounty keeps running alongside the deal, with its list of in-scope systems and a form for submitting findings.

OpenAI engineers and Hacktron’s researchers will choose the high-priority areas to test together. OpenAI says it got to know the team through the bug bounty, where the impact of the vulnerabilities Hacktron’s researchers found and disclosed impressed it. Hacktron builds AI agents for code review, penetration testing and red teaming, and OpenAI credits its research with uncovering flaws in how applications, cloud infrastructure and identity systems interact.

The bounty itself just got bigger. Earlier this week OpenAI said Cathedral’s researchers will work alongside its teams in the next security sprint, and it raised bug bounty rewards to give independent researchers more reason to chase what its own testing misses. Under the new ranges announced in November, a critical bug in ChatGPT, Codex or the API Platform earns up to $30,000, and exceptional findings reach up to $172,000 with quality, loyalty and campaign bonuses.

Hacktron’s team found gaps in OpenAI’s infrastructure in July, Business Insider reports. Per Hacktron’s disclosure, any user or OpenAI employee who logged into OpenAI’s community help forum could have had their ChatGPT and Codex accounts hacked. The team got into an OpenAI employee’s account and prompted that employee’s Codex to suggest changes in OpenAI’s internal code repository. Then it stopped, accessed no internal code and flagged the issue, Hacktron said, and its disclosure puts the bounty at only $6,500. An OpenAI spokesperson said: “We narrowed the permissions on Community sign-in tokens and revoked affected tokens and sessions.”

Zayne Zhang, Hacktron’s cofounder and CEO, said his research team has begun investigating frontier AI companies like OpenAI to find out whether they have gaps that AI agents could exploit.