Product1 publisher2 min readPublished
Researchers reached OpenAI's private repository through a forum bug and reused tokens
Hacktron AI found the flaw in Discourse, the outside platform running OpenAI's community forum, and some of the authentication tokens sitting on that server also worked on ChatGPT accounts held by OpenAI staff.
The Product Desk · Product desk
What happened
- The exploit exposed authentication tokens on the Discourse server, some of which were accepted by ChatGPT, including tokens belonging to OpenAI staff.
- The access extended to OpenAI's GitHub and a repository called Monorepo, said to hold much of the company's technical know-how but not the model weights.
- OpenAI paid the team $6,500, says both gaps are now closed, and Discourse shipped its fix the same day it was told.
Compiled by The Product DeskSomething wrong?How this is made
Why it matters
- exposure Any company whose staff sign into a vendor-hosted forum with a work identity now has a documented case of that vendor's server holding a credential a production app will accept.
- decision Security teams have to settle whether a community forum sits behind the same identity provider as their source control. That is a call about scope.
- capability The same exploit code failed and then worked after a model release, so defenders cannot treat attacker capability as fixed from one week to the next.
- cost The bounty priced the discovery at $6,500. Nobody budgets for the follow-on work of finding every place a vendor-held token is honoured, and it falls on the customer.
Somewhere in OpenAI's staff directory is a person who signed into the company's community forum and had no reason to think about it again. The forum runs on Discourse, an outside platform, and a team called Hacktron AI found a flaw in it, according to a Wall Street Journal report summarised by Digital Trends [1][4]. They had Claude write the exploit code, and they were working inside OpenAI's bug bounty program [2][4]. The first attempt failed. Then Anthropic released Opus 5, and the next day the code worked [5].
The exploit reached authentication tokens sitting on the Discourse server [6]. Some of those tokens were accepted by ChatGPT, and a few belonged to OpenAI employees [6]. The access carried on to OpenAI's GitHub and a repository called Monorepo, described in the report as holding much of the company's technical know-how, though not the model weights [7]. To show how far they had got, the researchers filed a small pull request tagged with their team's name, which OpenAI never approved [8].
Digital Trends' account does not explain why a token held on a forum server was honoured by ChatGPT, or how a ChatGPT session then opened a private GitHub repository.
OpenAI paid $6,500 for the chain [3]. Three researchers did the work with ordinary Claude and Codex subscriptions [11]. The split is about $2,167 each, before anyone counts hours [12].
The forum was the one system in the estate where a credential could sit under someone else's operational control. It holds no customer data. The vendor patches it. And employees sign into it with the identity they already have, from the browser where everything else is already open.
Two questions locate the same exposure in other vendor integrations. Can this vendor's servers end up holding a credential that one of your production systems will accept? And when you revoke, does that credential die on your clock or the vendor's? Anything that answers yes and theirs is in the position OpenAI's forum was in. The work there is scoping tokens to a single audience and cutting their lifetime, and that work sits with the customer: Discourse shipped its patch the day it was told, and the patch closed the leak without changing which systems would accept the tokens [10].
What to watch
- Whether Hacktron AI or the Wall Street Journal publishes the full chain from ChatGPT session to GitHub repository access.
- Whether OpenAI changes its bounty tiers for chains that start at a third-party vendor.
- Whether Discourse issues an advisory on other hosted forums holding tokens that outside services would accept.