OpenAI keeps much of its code in a single shared repository, allowing employees to access projects unrelated to their roles for several years. According to staff accounts, these risks were raised before the launch of ChatGPT in November 2022, without being addressed quickly enough. On July 25, 2026, researchers from Hacktron exploited a vulnerability in the company’s community forum and then reached the internal repository in under 72 hours through a misconfigured single sign-on system. OpenAI paid a $6,500 bug bounty, narrowed token permissions and redirected 25% of its production engineers toward strengthening its security infrastructure.
Source: Read the original article


