A 72-hour bug chain reached OpenAI’s internal monorepo
Hacktron says two critical vulnerabilities let its team compromise multiple OpenAI employees’ ChatGPT accounts and reach internal repositories in under 72 hours, showing how one forum flaw could expose connected developer tools. To prove access without reading sensitive code, the researchers used an employee’s Codex account to open harmless PR #1186742 in the private monorepo. OpenAI fixed its side roughly 14 hours after the report and paid a $6,500 bounty.