Entrepreneurship

Three People Hacked OpenAI. Then They Got Paid.

A three person team reached OpenAI’s internal code in under 72 hours this week, reported it, and collected $6,500. It is a real job your teenager can start learning at 14. Here is how it works and where the rules are.

Foundra Kids·8 min read

Three People Hacked OpenAI. Then They Got Paid.

What happened this week?

Three people at a small company called Hacktron AI broke into OpenAI. They reached employee accounts, and through those accounts they got to Outlook, Slack, GitHub and an internal OpenAI code repository.

It took them under 72 hours from the moment they found the first problem.

Then they wrote it up and sent it to OpenAI. OpenAI fixed its side in about 14 hours and paid them $6,500.

If that ending surprises you, you have just found the thing worth explaining to a kid who is interested in computers. Nobody went to jail. Nobody got sued. The whole exercise was invited, and the payment was the point.

Why was this allowed?

Because OpenAI asked for it. The company runs a bug bounty program, which is a standing public offer: find a security hole in our systems, tell us privately instead of using it, and we will pay you.

Almost every large tech company runs one now. Google, Apple, Microsoft, Meta, Shopify, most banks, the US Department of Defense. They do it because the alternative is worse. Someone is going to find the hole. The company would rather it be a person who emails them than a person who sells it.

The researchers here, Harsh Jaiswal, Mohan Pedhapati and Rahul Maini, chained together two problems. They started at community.openai.com, which is OpenAI's public forum. It runs on Discourse, off the shelf forum software, and it lets people sign in with their OpenAI accounts. That sign-in connection was the thread they pulled.

They also said clearly in their report that they did not use the access to take any sensitive information. That sentence is doing a lot of work, and we will come back to it.

Is this actually a job a teenager can do?

Yes, and the history is not short.

Santiago Lopez signed up for the bug bounty platform HackerOne in 2015, when he was 16, in Argentina, teaching himself from free material online. His first bounty came months later and was $50. In 2019 he became the first person on the platform to pass $1 million in total earnings.

Jack Cable found holes in Pentagon systems at 18 through a government program, interned there, and paid for a chunk of his Stanford tuition with bounty money.

They are the famous ones, which means they are not the typical ones. But the age pattern holds across the whole field: roughly 47.7% of the hundreds of thousands of registered hackers on HackerOne are between 18 and 24. This is a young person's field, mostly because it rewards stubbornness and free time more than credentials, and nobody asks for a degree.

What does it really pay?

Start with the number in this week's story, because it is the best reality check available. Three experienced professionals reached the internal code repository of one of the most valuable companies on earth, and were paid $6,500 for it. Split three ways.

That is not a lottery ticket. It is a fair professional fee for about three days of extremely skilled work.

Most bounties are far smaller. A first finding is often $50 to a few hundred dollars, which is exactly where Santiago Lopez started. Plenty of reports are closed as duplicates, meaning someone else reported the same thing first, and pay nothing. Plenty more are closed as "not a bug."

So the honest pitch to a 15 year old is not "you could make a million dollars." It is this: you can learn something real, in public, for free, and occasionally get paid actual money while you are still in high school. The skill is the asset. The bounties are proof the skill is real.

What are the rules, exactly?

This is the part that keeps it a career instead of a criminal record, and it deserves a slow, literal conversation.

Only test what the program says you can test. Every bug bounty program publishes a scope: these domains, these apps, these kinds of attacks. Anything outside that list is not authorized, and "I was trying to help" is not a defense.

Never take data. Once you have proven you can get in, stop. The Hacktron team's report says plainly that they did not use their access to obtain sensitive information. Looking is proving. Copying is stealing.

Report it, do not sit on it. Holding a vulnerability to use later, or to sell, is where this stops being security research.

Do not test your school, your friend's site, or a company that has no program. No published invitation means no permission, regardless of how easy the hole was to find.

Write it up properly. A good report explains what you found, how to reproduce it, and why it matters. Companies pay more for reports they can act on immediately. The writing is part of the job, which surprises most teenagers.

What should a kid actually learn first?

Not "hacking tools." The fundamentals, in roughly this order.

How a website actually works: what the browser sends, what the server sends back, what a cookie is, what a session is. How logging in works, especially the "sign in with Google" style flows, because that is precisely the mechanism the Hacktron team attacked. Some programming, enough to read other people's code and write small scripts.

Then practice on systems built to be broken. HackerOne and Bugcrowd both run free training ranges. PortSwigger's Web Security Academy is free and widely respected. TryHackMe and Hack The Box have structured paths. None of these require permission from anybody, because they exist to be attacked.

If your teenager gets good at this and starts thinking about doing it as a business rather than a hobby, that is a fine problem to have and a different skill set. Figuring out what to charge, who to sell to, and how the money works is its own kind of homework, and tools built for first-time founders, whether that is Foundra or a simple spreadsheet, help more than another tutorial does at that stage.

One more thing worth noticing about this week's story: the team used Claude to help them work. AI did not replace the security researchers. It made three of them fast enough to do what used to take a bigger team.

What should parents watch for?

Two things, pulling in opposite directions.

The first is the line. A kid who is good at this will eventually find something on a site that has no bounty program, possibly their own school's. The urge to poke at it is strong and the consequences are real. Have the conversation before it comes up, not after. The rule is simple enough for a 13 year old: no published invitation, no testing.

The second is the opposite worry. Do not shut this down because the word "hacking" is in it. This is one of the few technical fields where a motivated teenager can reach professional level before college, get paid by real companies, and build a public record of work that hiring managers take seriously. Security teams are chronically short of people.

A useful middle position: encourage the practice ranges enthusiastically, ask to read their first real report before they send it, and treat the first $50 the way you would treat a first paycheck from any job. Because it is one, and in the US that means it counts as earned income, which opens doors like a custodial Roth IRA that allowances never do.

Key takeaways

Bug bounties are invitations, not loopholes. The company publishes what you may test and pays you to report what you find.

The money is real but modest at the start. $6,500 for three experts and three days. $50 for a first finding is normal.

Age is not the barrier. Santiago Lopez started at 16. Nearly half of registered hackers on HackerOne are 18 to 24. Minors generally need a parent's involvement to register and get paid.

Scope and restraint are the whole job. Test only what is listed, prove access without taking data, report promptly, write it clearly.

Free practice exists. PortSwigger's Web Security Academy, TryHackMe, Hack The Box and the platforms' own training ranges cost nothing.

FAQ

How old do you have to be to join a bug bounty platform?

Platforms restrict accounts for children under 13 under US privacy law, and minors above that generally need a parent or guardian to consent and to handle the tax paperwork when money is paid out. Check the specific platform's terms, since they differ.

Could my kid get in trouble doing this?

Only by going outside an authorized scope. Testing a system nobody invited you to test is unauthorized access, and being a minor does not make it legal. Inside a published program, following its rules, this is ordinary paid work.

Do you need to be good at math?

Less than people assume. Persistence, careful reading and comfort with how systems fit together matter more than advanced math.

Is AI making this field disappear?

It changed the work rather than removing it. The Hacktron team used Claude and moved faster because of it. Somebody still had to know where to look and what the finding meant.

What is a realistic first year?

Several months of learning on practice ranges, then a first real report that is probably closed as a duplicate, then eventually a small payout. Treat anything in the first year as tuition you did not pay.

Where does a total beginner start tonight?

PortSwigger's Web Security Academy. It is free, it starts from nothing, and it is the same material working professionals recommend to each other.

Sources

Ready to help a young entrepreneur get started?

Foundra Kids gives young founders a simple, fun way to plan their first business.

Try Foundra Kids