Primary source SecurityX post·19 September 2026·4 min read

"On July 25, we hacked OpenAI": two bugs, 72 hours, one internal PR

Security researcher s1r1us claims to have taken over OpenAI employees' ChatGPT and Codex accounts, and proved it by pushing a pull request into the internal codebase.

Source : s1r1us (@S1r1u5_) · X (Twitter) · 18 September 2026View original ↗

In brief

Security researcher s1r1us claims to have chained two vulnerabilities to take control of ChatGPT/Codex accounts, including OpenAI employees', and reach connected services: Outlook, Slack, GitHub. The proof offered is a pull request dropped into OpenAI's internal codebase, achieved in under 72 hours. The episode illustrates the new weak point of AI assistants: they're no longer chatbots, they're accounts wired into a company's entire infrastructure.

🍺 Bar-stool version

Two flaws, three days, and researchers end up pushing code into OpenAI's internal repo. The part that stings isn't the ChatGPT account itself: it's that this account holds the keys to Outlook, Slack, and GitHub, like a keyring generously taped to the front door. We've spent two years asking AI assistants to connect to everything, and we're now discovering with great emotion that "connected to everything" also means "compromised everywhere." When the agent has a colleague's privileges, stealing it is the same as hiring an intruder with a badge.

Key takeaways

1
s1r1us publicly announces having compromised ChatGPT and Codex accounts on July 25, including OpenAI employees' and a few unaffiliated users'.
2
Two chained vulnerabilities were enough to achieve an account takeover.
3
The compromise didn't stop at ChatGPT: it granted access to connected services, with Outlook, Slack, and GitHub cited.
4
The proof of impact is a pull request dropped into OpenAI's internal codebase.
5
The entire exploitation chain reportedly took less than 72 hours.
6
The thread is published after the fact, suggesting a coordinated disclosure with a fix, even though the opening tweet doesn't specify it.

What the announcement says

The thread's opening message is blunt: "On July 25, we hacked OpenAI." Two bugs, exploited in a chain, allegedly allowed control to be taken over ChatGPT and Codex accounts belonging to OpenAI employees, as well as a few users with no connection to the company.

The claimed scope goes beyond the product itself. Once the account was taken over, the researchers say they reached the services connected to it: Outlook, Slack, GitHub, with the list explicitly left open by an "etc."

The final demonstration is the most telling part for an engineer: a pull request dropped into OpenAI's internal codebase. This is no longer a screenshot of a stolen session, it's an action written into a company's production system. All in under 72 hours.

Why a Codex account isn't like any other account

A regular ChatGPT account grants access to a conversation history, which is already sensitive. A Codex account, though, is a development account: it's wired into code repositories, it executes tasks, it produces commits.

The difference matters fundamentally in terms of threat model. Stealing a chatbot session is data exfiltration. Stealing an agentic coding session is gaining the ability to act inside the company's perimeter, with an employee's privileges.

That's exactly what the pull request cited in the thread demonstrates. The question is no longer "what could the attacker read," but "what could the attacker write."

The real culprit: the connector attack surface

For two years, the industry has been pushing the AI assistant to the center of the workstation. We hook it up to email, internal chat, the code manager, drive, CRM. Each connector is one more access token stored behind a single identity.

This architecture concentrates risk dramatically. The assistant's account becomes a convergence point for permissions that, historically, were siloed across multiple tools and multiple authentication procedures.

s1r1us's announcement gives a concrete case to this theoretical worry: two application bugs, and the chain propagates from the assistant all the way to Outlook, Slack, and GitHub. The security of the whole boils down to the security of the weakest authentication link.

What the tweet doesn't say

The opening message doesn't detail the technical nature of the two vulnerabilities, the exact initial vector, or the precise number of accounts affected. It also doesn't mention any official response from OpenAI, nor a bug bounty amount.

The fact that the publication comes well after July 25 is the usual sign of responsible disclosure: researchers report, the vendor fixes, the thread comes out afterward. But until public confirmation is attached, this remains a likely reading rather than a fact established by the source.

At this stage, the announcement should be treated for what it is: a first-hand account from a team of researchers, with strong proof of impact and technical details deferred to the rest of the thread.

“On July 25, we hacked OpenAI.”

“We proved it with a PR in OpenAI's internal codebase. It took us <72h.”

Why it matters

The industry has spent months discussing "AI" risks in the abstract: prompt injection, hallucinations, alignment. This episode brings the topic back to a much more mundane and far more dangerous reality: classic application security. Two authentication bugs are enough to turn an assistant into a gateway to the email, internal chat, and source code of one of the most scrutinized companies in the world. The critical point isn't the model, it's the scope of permissions entrusted to it. As long as agents accumulate an employee's access without the corresponding controls (access reviews, MFA on every service, segmentation), every authentication flaw in the assistant will mechanically become a flaw across the entire company. For CIOs deploying Codex, Copilot, or equivalents internally, the lesson is direct: audit the connectors before auditing the prompts.

#security #openai #chatgpt #codex #agents

Original source

On July 25, we hacked OpenAI.

s1r1us (@S1r1u5_)

Open the post ↗