Researchers Chain Two Flaws in OpenAI's Help Forum to Reach Employee Accounts and Internal Code

Security researchers at Hacktron report that on July 25, 2026, they chained two critical vulnerabilities to compromise several OpenAI employees' ChatGPT accounts. They say they gained remote code execution and administrative access to the Discourse forum software behind community.openai.com, OpenAI's help forum. Until about two months before their write-up, any user or employee logging into that forum could have had their ChatGPT and Codex accounts taken over.

The potential reach was wide because people can connect other services to these accounts, including GitHub, Slack and email. To prove the access was real without viewing sensitive information, the researchers used an employee's Codex to open a harmless pull request in OpenAI's internal code repository. They say the whole process, from first discovery to repository access, took under 72 hours, and they stopped testing once the proof was made.

The team reported the issue through OpenAI's bug bounty program, and OpenAI confirmed a fix about 14 hours later. They also reported it to Discourse, which had a fix ready the next Monday, added extra sandboxing for image processing, and published an advisory (GHSA-vhm9-85gw-x335) with patch and rebuild guidance. OpenAI paid a $6,500 bounty. This summary covers only the opening of the original article.