OpenAI Hired the Hackers Who Breached It — Your API Is Next

OpenAI named Hacktron, the security research firm that breached its systems, as its official red-team partner on November 6. On July 25, Hacktron researchers chained a remote code execution flaw in the image-processing pathway of OpenAI's Discourse-hosted community forum with an OpenAI SSO weakness to reach OpenAI's internal GitHub repositories. The partnership reflects OpenAI's position that AI integrations have created an attack surface standard bug bounty programs can no longer cover alone.

OpenAI just hired the security firm that broke into it. On November 6, Hacktron — the researchers who chained a community forum RCE with an SSO flaw to reach OpenAI’s internal GitHub repos — became its official red-team partner. The move is a blunt acknowledgment that AI integrations have created an attack surface that standard bug bounty programs can no longer cover alone. The Exploit That Earned Them a Job Offer On July 25, Hacktron researchers chained two vulnerabilities. First: a remote code execution flaw in the image-processing pathway of OpenAI’s Discourse-hosted community forum. Second: an OpenAI SSO weakness that … The post