Two bugs let hackers hijack OpenAI employee accounts in 72 hours, reaching monorepo
JeffLadish · x · 2026-09-18
Security researcher S1r1u5 claims that on July 25 two bugs allowed taking over ChatGPT/Codex accounts of OpenAI employees and some unrelated users, reaching connected services like Outlook, Slack and GitHub — proven by opening a PR in OpenAI's internal codebase, all in under 72 hours.
Jeff Ladish points out the bigger implication: full monorepo access means the attackers could potentially have downloaded OpenAI's entire codebase. The claim is researcher-reported; OpenAI has not yet responded officially.
More from Companies & People
- John Lewis's worst-reviewed Christmas ad: why it wants to stop cash gift cards — aakashgupta · 2026-11-04
- Technical founders: as CEO, storytelling is the core job you can't skip — paigeinsf · 2026-11-04
- Andreessen: Agents Are Entering Enterprises as Chaos, Just Like PCs and Spreadsheets Did — Dan_Jeffries1 · 2026-11-04
- DeepMind, Cognition host bouldering social ahead of AI Engineer Code Summit — osanseviero · 2026-11-04
- Google says it removed post-employment non-disparagement clauses from new-hire terms — HaydnBelfield · 2026-11-04
- Accenture Accused of Publishing AI Paper Littered with AI Hallucinations — nordicinst · 2026-11-04