Primary source SecurityX post·19 September 2026·4 min read

"On July 25, we hacked OpenAI": two bugs, 72 hours, one internal PR

Security researcher s1r1us claims to have taken over OpenAI employees' ChatGPT and Codex accounts, and proved it by pushing a pull request into the internal codebase.

ShareWhatsApp X LinkedIn Facebook

Save to my selection

"On July 25, we hacked OpenAI": two bugs, 72 hours, one internal PR

Source : s1r1us (@S1r1u5_) · X (Twitter) · 18 September 2026View original ↗

In brief

Security researcher s1r1us claims to have chained two vulnerabilities to take control of ChatGPT/Codex accounts, including OpenAI employees', and reach connected services: Outlook, Slack, GitHub. The proof offered is a pull request dropped into OpenAI's internal codebase, achieved in under 72 hours. The episode illustrates the new weak point of AI assistants: they're no longer chatbots, they're accounts wired into a company's entire infrastructure.

🍺 Bar-stool version

Two flaws, three days, and researchers end up pushing code into OpenAI's internal repo. The part that stings isn't the ChatGPT account itself: it's that this account holds the keys to Outlook, Slack, and GitHub, like a keyring generously taped to the front door. We've spent two years asking AI assistants to connect to everything, and we're now discovering with great emotion that "connected to everything" also means "compromised everywhere." When the agent has a colleague's privileges, stealing it is the same as hiring an intruder with a badge.

Key takeaways

1
s1r1us publicly announces having compromised ChatGPT and Codex accounts on July 25, including OpenAI employees' and a few unaffiliated users'.
2
Two chained vulnerabilities were enough to achieve an account takeover.
3
The compromise didn't stop at ChatGPT: it granted access to connected services, with Outlook, Slack, and GitHub cited.
4
The proof of impact is a pull request dropped into OpenAI's internal codebase.
5
The entire exploitation chain reportedly took less than 72 hours.
6
The thread is published after the fact, suggesting a coordinated disclosure with a fix, even though the opening tweet doesn't specify it.

What the announcement says

The thread's opening message is blunt: "On July 25, we hacked OpenAI." Two bugs, exploited in a chain, allegedly allowed control to be taken over ChatGPT and Codex accounts belonging to OpenAI employees, as well as a few users with no connection to the company.

Why a Codex account isn't like any other account

A regular ChatGPT account grants access to a conversation history, which is already sensitive.

The real culprit: the connector attack surface

For two years, the industry has been pushing the AI assistant to the center of the workstation.

What the tweet doesn't say

The opening message doesn't detail the technical nature of the two vulnerabilities, the exact initial vector, or the precise number of accounts affected.

Why it matters

The industry has spent months discussing "AI" risks in the abstract: prompt injection, hallucinations, alignment.

Older than 30 days: the archive

This article is more than 30 days old

A free account opens articles from the last 30 days in full. The full archive is in the Pro plan.

Create my account

Already a member? Log in

Compare plans →

#security #openai #chatgpt #codex #agents

Original source

On July 25, we hacked OpenAI.

s1r1us (@S1r1u5_)

Open the post ↗

For you

Put it to work on your sources.

Free: a month of articles and three sources of your own. Pro: the whole archive and your sources, from €8/month.

Create my account →

For your team

The same machine, on your topics.

A space in your colours, your watch angles, your curators. Pilot open to three companies.

Request pilot access →