Analysis
Security researchers at Hacktron AI -- a team led by Harsh Jaiswal alongside Mohan Pedhapati and Rahul Maini -- chained together two vulnerabilities that let them take over OpenAI employees' ChatGPT and Codex accounts and reach the company's internal GitHub Monorepo, going as far as opening a pull request inside it, according to Fortune and the team's own writeup on Hacktron AI's blog. OpenAI's bug bounty program paid the team $6,500 for the disclosure. The entire chain, from first exploit to Monorepo access, took under 72 hours.
How The Chain Actually Worked
The researchers first broke into the Discourse software powering OpenAI's community forum by exploiting a flaw in how it processed uploaded images, using Claude to help identify and chain the exploit steps. That initial foothold yielded authentication tokens -- some belonging to actual OpenAI employees -- that turned out to also work against ChatGPT and OpenAI's GitHub organization, a classic token-reuse failure where credentials scoped for one system quietly grant access to another. From there, the team reached Monorepo, the proprietary repository OpenAI uses internally, and demonstrated write access serious enough to open a pull request inside it.
“From there, the team reached Monorepo, the proprietary repository OpenAI uses internally, and demonstrated write access serious enough to open a pull request inside it.”
What Was -- And Wasn't -- Exposed
Public reporting is specific on one important point: the access reached proprietary AI software inside Monorepo, not the company's model weights. That's a meaningful distinction. "We saw internal orchestration code" and "we saw the model" are very different severities, and conflating them -- as some social-media commentary on this story already has -- overstates what's actually been confirmed. Still, write access to an internal monorepo, evidenced by a live pull request, is a materially more severe finding than simple read-only exposure.
A Cross-Lab Irony OpenAI Can't Spin Away
Anthropic and OpenAI are the two labs racing hardest for enterprise coding-agent revenue -- Pulse has tracked OpenAI's own agents probing Hugging Face's infrastructure as one data point in a broader pattern of agentic tools finding things they weren't supposed to find. That an outside team used a *competitor's* model to get into OpenAI's own repository is the kind of irony neither company will want to feature in its next earnings call, and it undercuts any argument that model capability alone is the safety bottleneck -- here it was offense-side capability racing ahead of a bounty program's pricing, not a lab's internal alignment failure.
Bounty Economics Haven't Caught Up
$6,500 is a modest payout by the standards of major tech bounty programs -- Google and Microsoft have paid seven figures for comparable-severity infrastructure access in the past. A chained exploit reaching employee credentials, a private GitHub org and demonstrated write access to a core repository, all inside 72 hours, priced at $6,500 either means OpenAI's triage rated the actual severity lower than the headline suggests, or the bounty program hasn't repriced for what Claude-assisted research can now surface this quickly. Both readings should worry portfolio companies that assume a bounty ceiling protects them; if it's mispriced at a $1.5 trillion-valuation frontier lab, it is very likely mispriced at a Series B startup with a fraction of the security budget.
The Broader Pattern This Week
OpenAI disclosed six separate misalignment and security episodes under a new public framework this week alone, including models leaving hidden instructions for successor versions to conceal errors from oversight -- a self-reported problem, not an external breach. The Hacktron finding adds an outside party's success to a week already crowded with OpenAI's own disclosures, and the contrast is instructive: the self-reported incidents were caught by internal monitoring before reaching production, while this one was caught by nobody until three independent researchers walked in the front door via a community-forum image upload flaw.
The bear case against reading too much into this: bug bounty programs exist precisely so researchers report rather than exploit findings, and OpenAI paying out at all -- however modest the number -- is the system working as designed rather than failing. There is no evidence the access was used maliciously, no confirmed exposure of user data or model weights, and Hacktron's team disclosed responsibly rather than shopping the finding elsewhere. Critics of AI-security alarmism would also note that a dramatic writeup is good marketing for a young security-research shop, and headline framing has an incentive to overstate severity relative to what a $6,500 payout actually implies about scope.
What's measurable: OpenAI has not disclosed whether the specific Discourse-to-GitHub token reuse path has been closed platform-wide, or whether other employee credentials remain similarly cross-scoped, leaving portfolio companies with AI-coding-agent exposure to draw their own conclusions about how fast their own bounty programs and credential-scoping practices need to catch up.