OpenAI 与安全公司 Hacktron 结成正式测试伙伴：专查与第三方服务的连接面，Hacktron 获 Daybreak Red 前沿模型扩大访问权
OpenAI 11 月 6 日宣布与进攻性安全公司 Hacktron 结成伙伴关系，请这家外部团队为 OpenAI 自身系统查找漏洞。按公告，双方工程师与安全研究员将共同选定高优先级的测试领域，重点放在 OpenAI 系统与第三方服务交互的连接面上；作为合作的一部分，OpenAI 扩大 Hacktron 经其受限计划 Daybreak Red 使用前沿模型的权限。Daybreak Red 是 OpenAI 面向经审核的进攻性安全工作开放的层级，提供为授权漏洞研究、利用验证与安全测试专门训练的网络安全模型。
两家公司的关系始于 OpenAI 的安全漏洞赏金计划。OpenAI 表示，正是通过该计划认识 Hacktron，并对其研究员发现并披露漏洞的影响留有深刻印象。Hacktron 的业务是构建用于代码审查、渗透测试与红队演练的智能体，其研究曾揭示应用、云基础设施与身份系统交互方式中的弱点。Hacktron 首席执行官 Zayne Zhang 在公告中表示，公司乐于深化与 OpenAI 的伙伴关系，把自身的进攻性安全专长与 OpenAI 的前沿模型结合，帮助保障 OpenAI 与更广泛的软件生态。
Hacktron 此前披露的一次发现为此次合作提供了背景。据 Hacktron 9 月 13 日的说明，其研究员 7 月 25 日把两个漏洞串联利用—一处在 OpenAI 使用的 Discourse 社区论坛图像处理路径中，一处在 OpenAI 的单点登录环节—从而接管了多名 OpenAI 员工的 ChatGPT 账户，并可能进一步触及内部代码库等连接服务；Hacktron 称 OpenAI 在收到报告约 14 小时后确认修复，并于 9 月 1 日支付 6,500 美元赏金。OpenAI 的本次公告本身没有披露任何新的漏洞或测试结果，内容为测试范围与合作安排。
OpenAI Makes Hacktron a Formal Security Testing Partner: Joint Focus on Third-Party Service Connections, With Expanded Daybreak Red Model Access
OpenAI announced on November 6 that it has partnered with offensive security firm Hacktron to find vulnerabilities in OpenAI's own systems. Under the announcement, OpenAI engineers and Hacktron security researchers will jointly select high-priority areas to test, with a focus on how OpenAI's systems interact with third-party services. As part of the partnership, OpenAI is expanding Hacktron's access to its frontier models through Daybreak Red, its restricted tier that provides purpose-trained cybersecurity models for authorized vulnerability research, exploit validation and security testing.
OpenAI said it became familiar with Hacktron through its Security Bug Bounty program and was impressed by the impact of the vulnerabilities the firm's researchers discovered and disclosed. Hacktron builds AI agents for code review, penetration testing and red teaming, and its research has uncovered vulnerabilities in interactions among applications, cloud infrastructure and identity systems. Hacktron chief executive Zayne Zhang said in the announcement that the company is excited to deepen its partnership with OpenAI, combining its offensive security expertise with OpenAI's frontier models to help secure OpenAI and the broader software ecosystem.
An earlier Hacktron disclosure forms the backdrop. In its September 13 account, Hacktron said its researchers chained two vulnerabilities on July 25 — one in the image-processing path of the Discourse community forum OpenAI uses, and one in OpenAI's single sign-on — to compromise multiple OpenAI employees' ChatGPT accounts, creating potential access to internal repositories and other connected services. Hacktron said OpenAI confirmed a fix roughly 14 hours after the report and paid a $6,500 bounty on September 1. OpenAI's partnership announcement itself discloses no new vulnerability or test result; it sets out the testing scope and the arrangement.
来源：OpenAI
发布：GSM·美国（发布链接）
图片来源：图：OpenAI 标志。Wikimedia Commons，公共领域（PD-textlogo）。 / Photo: OpenAI logo. Wikimedia Commons, public domain (PD-textlogo).
GSM Global · 本篇英文版 English edition of this story
