Hackers claim to have breached OpenAI, company says vulnerabilities patched
A cybersecurity firm reported that it accessed OpenAI employee accounts by exploiting two separate flaws, prompting OpenAI to confirm the breach and say the issues have been fixed.
A small cybersecurity team from Hacktron said it gained access to OpenAI employee ChatGPT accounts in late July by linking two previously unknown vulnerabilities—one in a third-party forum software and another in OpenAI’s employee authentication process. The researchers said they completed the operation within 72 hours and did not damage any systems.
OpenAI confirmed the report, stating the flaws have been patched, and thanked the researchers for disclosing the findings. The company’s bug-bounty program paid Hacktron $6,500 for the discovery.
The incident comes amid heightened public discussion of AI safety and security. Some experts have warned that vulnerabilities in AI firms could be exploited by sophisticated attackers, including state-backed groups. Greg Linares, a researcher at authentication firm Persona, said the technique used by Hacktron resembles methods employed by advanced persistent threat actors and underscores the need for ongoing vigilance.
No evidence has emerged that other parties have used the same vulnerabilities, and OpenAI has not reported any further compromise.