OpenAI brings in Hacktron to hunt vulnerabilities in its own systems

As part of the deal, OpenAI is expanding Hacktron's access to its frontier models through Daybreak Red[1]. Daybreak Red is the top tier of OpenAI's Daybreak trusted access for cyber program, aimed at authorised penetration testing, red teaming, exploit validation and controlled vulnerability research[3]. It is only available to approved business and enterprise organisations, needs separate approval with stronger verification and access controls, and includes GPT-5.6 Cyber, with GPT-6 Cyber available only under a separate model approval[3].

OpenAI says it got to know Hacktron through its Security Bug Bounty program and was impressed by the impact of the vulnerabilities its researchers disclosed[1]. Hacktron builds AI agents for code review, penetration testing and red teaming, and its research has uncovered weaknesses in how applications, cloud infrastructure and identity systems interact[1][4].

"The future of cybersecurity won't be defined by who has the largest security team, but by who can best combine human creativity with AI-driven capabilities," said Hacktron CEO Zayne Zhang[1][2].

The partnership follows OpenAI's news earlier in the week that researchers from Cathedral will work alongside its teams in the next security sprint, and that it has raised bug bounty rewards to encourage independent researchers to chase vulnerabilities its own testing may miss[1][4].

OpenAI is selling frontier models as cyber defence tools, so turning those same models on its own attack surface is both a credibility test and a practical one. The focus on third-party connections reflects where agent-era risk is growing: at the seams between services, not inside any single app[1].