Researchers Reached OpenAI's Private Monorepo via Discourse Forum Bug, Earned $6,500 Bounty
ChrisGPT · x · 2026-09-18
Three researchers found a vulnerability in the Discourse system hosting OpenAI's community forums, obtained auth tokens that also worked on an employee's ChatGPT/GitHub access, and reached OpenAI's private monorepo. They stopped short of sensitive material, proved access with a harmless pull request, responsibly disclosed, and were paid $6,500. No evidence model weights were accessed.
More from Companies & People
- John Lewis's worst-reviewed Christmas ad: why it wants to stop cash gift cards — aakashgupta · 2026-11-04
- Technical founders: as CEO, storytelling is the core job you can't skip — paigeinsf · 2026-11-04
- Andreessen: Agents Are Entering Enterprises as Chaos, Just Like PCs and Spreadsheets Did — Dan_Jeffries1 · 2026-11-04
- DeepMind, Cognition host bouldering social ahead of AI Engineer Code Summit — osanseviero · 2026-11-04
- Google says it removed post-employment non-disparagement clauses from new-hire terms — HaydnBelfield · 2026-11-04
- Accenture Accused of Publishing AI Paper Littered with AI Hallucinations — nordicinst · 2026-11-04