Researchers hacked OpenAI in under 72 hours; got only $6,500 as one vector 'out of scope'
random_walker · x · 2026-09-19
Security team @S1r1u5 (HacktronAI) revealed that on July 25 they used two bugs to take over ChatGPT/Codex accounts of OpenAI employees (plus some external users) and reach connected services including Outlook, Slack, and GitHub — proving it with a PR into OpenAI's internal codebase in under 72 hours.
The controversy: OpenAI paid only a $6,500 bounty, citing one attack vector as "out of scope." AI safety researcher @sayashk called this atrocious — OpenAI talks a big game about AI for cyberdefense, but if companies actually want a flood of defenders auditing their systems, signing letters isn't enough; they need to take bounties seriously.
More from Safety
- Hundreds of offensive ARTEX AI agents deployed across VPS providers, hitting Korean banks — IgorCarron · 2026-11-04
- UK NCSC: AI will speed up and scale existing cyber attacks, not create new ones — koltregaskes · 2026-11-04
- Anthropic says it may imminently hit RSP threshold for AI-accelerated R&D, releases provable inference work — tobyordoxford · 2026-11-04
- Hackers reset French blood service freezers from -30°C to 110°C in supply-chain cyberattack — LuizaJarovsky · 2026-11-04
- Google says it removed post-employment non-disparagement clauses from new-hire terms — HaydnBelfield · 2026-11-04
- Claude doesn't really forget: Anthropic's privacy policy allows records retention up to 7 years — nikola_mr64990 · 2026-11-04