Hackers say they took over OpenAI employee ChatGPT accounts in under 72 hours via two bugs
nptacek · x · 2026-09-18
Hacker team S1r1u5 claims that on July 25 they exploited two bugs to hijack ChatGPT/Codex accounts of OpenAI employees (plus some outside users), then reached connected services like Outlook, Slack and GitHub. As proof, they submitted a PR to OpenAI's internal codebase — the whole operation took under 72 hours.
Commenters note the exploited flaw involved the very third-party library mocked in a classic xkcd comic: "the prophecy is fulfilled." A stark supply-chain security lesson that even top AI labs aren't immune to.
More from Fun
- AI cites Hume on the 'no stable self', and the internet runs with it — StewartalsopIII · 2026-11-04
- Designer creates full 5-weight Arabic-English typeface in one night using Claude as art director — aziz4ai · 2026-11-04
- Hermes app screenshot shows dozens of identical icons covering the whole iPad screen — Teknium · 2026-11-04
- Astrophysicist's bio flagged for trademark infringement — 'Dark Universe' belongs to Universal — Space_Mog · 2026-11-04
- AI video imagines an Englishman in New York: tea, umbrella and a very confused vibe — MandelDuck · 2026-11-04
- Training an LLM Explained as a Cricket Match: AI Community Meme — cneuralnetwork · 2026-11-04