OpenAI and Hacktron: a forum hack reached Codex and GitHub

OpenAI just hired the people who got in through its forum. On November 6, OpenAI announced a partnership with Hacktron, an AI security startup, to hunt for vulnerabilities in its systems. The focus is "how our systems interact with third-party services." That focus has a backstory. In July, Hacktron chained a bug in OpenAI's community forum through single sign-on (SSO) into ChatGPT, Codex and a GitHub repository. For a small business, the lesson is about SSO blast radius, not OpenAI.

What actually happened

The partnership is short on detail but clear on direction. Per OpenAI's post:

• Joint targeting. OpenAI engineers and Hacktron researchers will pick high-priority areas to test together, with a focus on third-party service connections.
• More model access. Hacktron gets expanded access to OpenAI's frontier models through Daybreak Red, OpenAI's restricted program for offensive security work.
• How they met. Through OpenAI's Security Bug Bounty program. Hacktron builds AI agents for code review, penetration testing and red teaming.

Hacktron's own write-up, published in September, shows the chain that got OpenAI's attention:

1. The forum. A heap overflow in libheif, the HEIF image decoder in the Docker image behind OpenAI's Discourse community forum. One image upload gave remote code execution.
2. The SSO. The forum used "Sign in with OpenAI." Hacktron says an SSO misconfiguration let it take over the ChatGPT and Codex accounts of active forum members without any clicks.
3. The repo. One of those accounts was an OpenAI employee's, with Codex connected to OpenAI's GitHub organization. Hacktron had Codex open a harmless pull request in an internal repository, then stopped.

Hacktron says it went from bug to internal repositories in under 72 hours, with AI models doing much of the exploit work and humans steering. OpenAI confirmed a fix about 14 hours after the report. It paid a $6,500 bounty, noting the forum itself was out of scope and the award covered the OpenAI-side SSO finding.

Why it matters for your business

Every app that uses your "Sign in with Google" or Microsoft login is part of your security boundary. That includes the forum, the help desk, and the free tool someone tried once. The weakest app that trusts your sign-in sets the risk for every app it can reach.

AI agents raise the stakes. A coding agent connected to GitHub turns one stolen session into a pull request. Here's what we'd do:

1. List every app that uses your SSO. Your Google or Microsoft admin console shows connected apps. Remove the ones nobody uses.
2. Rank by what a session can reach, not by how important the app looks.
3. Scope agent access. Give coding agents repo-level tokens, not org-wide access.
4. Protect main. Require human review on every pull request, agent-authored or not.

Sources: OpenAI, Hacktron.