Hacktron researchers used AI assistance to reach OpenAI employee accounts and demonstrate access to an internal code repository.
Source: HacktronAccount-access proof: July 25. Research report: September 13. OpenAI’s response reported: September 18.
Hacktron says Claude helped turn an image-processing flaw into a way to control a server, with skilled human guidance.
HacktronA flaw in the forum’s image reader allowed uploaded images to run code on its server.
DiscourseOpenAI said the forum’s digital sign-in passes granted too much access, including to associated ChatGPT and Codex accounts.
OpenAI response to SecurityWeekResearchers used an employee’s Codex account to submit a change request to OpenAI’s internal repository.
HacktronImagine a visitor badge for a discussion room also unlocking an employee’s office. Inside, the employee has an assistant authorized to submit work to another department. The danger comes from permissions carrying across boundaries that should be separate.
An analogy for the mechanism; not an additional claim about the incident.OpenAI told SecurityWeek that some private-repository details and recorded code changes were read, before a proposed change to its introduction file (README). OpenAI response to SecurityWeek
Discourse confirmed the underlying image-processing flaw and published a fix. Discourse
Security research involving real systems; part of the testing exceeded the bounty program’s scope. Hacktron reproduces OpenAI’s clarification that the forum was excluded.
OpenAI said access to employee Slack messages was not verified. Broad data theft or financial loss is not established.
The researchers describe their own actions; OpenAI’s response is reported by SecurityWeek. The advisory corroborates the software flaw, not every action.
Editorial lesson: a modest service can become a route into more sensitive systems when login permissions and connected tools reach too far. AI can help researchers investigate weaknesses, while an organization’s own AI tools can also extend what an intruder is able to do. Check both sides of that relationship.
People directed the research and applied the AI-developed exploit to OpenAI’s forum. This was not fully autonomous hacking. Hacktron
OpenAI told SecurityWeek it restricted the permissions of forum sign-in tokens—digital passes—and invalidated affected passes and login sessions. OpenAI response to SecurityWeek
Editorial defense mapping: distinguish the external researchers’ tools from the organization’s own accounts and connected assistant. These controls reduce risk; none is a promise that this event would have been prevented.
Track the libraries used by internet-facing services, apply security fixes, and isolate processing of untrusted files from sensitive systems.
An upstream patch can be missing from a deployed package. Inventory and version checks alone do not prove that an installation is protected.
Check that a login for one service cannot grant access to unrelated services. Review token permissions and make revocation part of incident response.
A successful login proves an identity was accepted; it does not justify broad access. This connection is about identity boundaries, not a claim that a cloud product would have stopped the event.
For the owner of the employee account: restrict connected repositories and actions, require review for consequential changes, and log who initiated each tool action.
These controls concern the organization’s own assistant. They do not control outside researchers’ AI, and approval of a proposed code change does not by itself prevent earlier reads.
Editorial connections to relevant controls, not evidence that a particular technology would have prevented this case. Each guide links to the security guidance behind its recommendations.
Explore the full AI security frameworkExplore more original accounts in the source report library ↗.
These are source-reported findings. An independent assessment, when available, is labeled explicitly.
01Read this case’s update history →
Reviewed Sep 18, 2026 · Editorial methodology · Structured data