A security research team called Hacktron AI breached OpenAI’s internal systems in July 2026, gaining access to employee ChatGPT and Codex accounts as well as the company’s private GitHub repositories. The researchers exploited two distinct vulnerabilities: a heap buffer overflow in the libheif library and an overly permissive SSO token. In just 72 hours, they developed their exploits using a specialized version of Anthropic’s Claude Opus model. OpenAI patched the vulnerabilities within 14 hours and awarded a $6,500 bounty. The company confirmed that no sensitive user data or production systems were compromised.
Source: Read the original article
