A team of security researchers from HacktronAI exploited chained vulnerabilities to gain access to OpenAI employee ChatGPT accounts and the company's internal monorepo on July 25, 2026. The breach exposed a critical weakness in how OpenAI's identity infrastructure connected to its community forum—and what an attacker could do once inside.
The researchers, Harsh Jaiswal, Mohan Pedhapati, and Rahul Maini, reported their findings through OpenAI's bug bounty program and received a $6,500 payment. The vulnerability had existed for roughly two months before discovery.
The attack chain started with two separate failures: an SSO misconfiguration in OpenAI's identity system and vulnerabilities in the Discourse environment hosting community.openai.com, the company's help forum. Together, they gave HacktronAI remote code execution and administrative access to Discourse. From there, the researchers could impersonate any employee who had logged into the community site.
Once authenticated as an employee, HacktronAI accessed the internal monorepo openai/openai—a single repository containing multiple OpenAI projects. The team demonstrated full write access by opening pull request #1186742. More significantly, they could have pivoted to connected services: GitHub, Slack, and employee email accounts linked to compromised ChatGPT and Codex identities.
The entire process took less than 72 hours from discovery to gaining monorepo access. HacktronAI reported through Bugcrowd immediately. OpenAI confirmed a fix 14 hours later.
The company clarified that the $6,500 bounty covered only the OpenAI-side SSO vulnerability. Testing against Discourse itself fell outside OpenAI's bounty scope. HacktronAI separately reported the Discourse vulnerability to that company's HackerOne program. Discourse deployed a fix by the following Monday and added image-processing sandboxing as additional defense, later releasing patch GHSA-vhm9-85gw-x335.
For an AI lab managing large-scale compute infrastructure and trained models, the incident underscores a familiar risk: employee account takeover can grant adversaries access to systems far more valuable than the compromised identity alone. The quick response limited damage. The question is whether such chained vulnerabilities remain endemic to OpenAI's sprawling authentication surface.
