{"slug": "did-hacktron-s-openai-probe-go-too-far", "title": "Did Hacktron's OpenAI probe go too far?", "summary": "Security researchers at Hacktron used Anthropic's Claude Opus 5 model to exploit a zero-day flaw in the libheif open-source image decoder and an SSO misconfiguration to take over an OpenAI employee's account, then used that employee's Codex to open pull request #1186742 in OpenAI's internal monorepo to prove the access was real. The benign pull request drew criticism from security professionals who objected to researchers taking the same actions a malicious hacker would, following Hacktron's Thursday disclosure of the earlier-this-year probe.", "body_md": "Enterprise tech got another reminder last week that OpenAI's cybersecurity posture needs some improvement, after security researchers showed how they were able to break into the frontier model company's GitHub account. But that account drew fire over the weekend from security professionals concerned about their decision to actually mess around in that account once they had gained access.\n\nHacktron [announced](https://www.thestack.technology/how-security-researchers-used-anthropic-to-hack-openai/) [Thursday](https://www.thestack.technology/how-security-researchers-used-anthropic-to-hack-openai/) that earlier this year it used Anthropic's Claude Opus 5 model to find and exploit a zero-day flaw in libheif — an open-source image decoder used with forum software such as Discourse — to get into OpenAI's forums and exploit a separate SSO (single sign-on) misconfiguration to take over an OpenAI employee's account. To this point, it appeared to be a pretty standard bug bounty exercise probing an important company's security posture, and then the researchers went a little farther.\n\n\"To prove we had in fact gained the access we believed without allowing ourselves to learn any sensitive information, we used the employee’s Codex to open a PR #1186742 in OpenAI’s internal monorepo,\" Hacktron researchers [said in a blog post last week](https://www.hacktron.ai/blog/hacking-openai?ref=thestack.technology). The pull request was benign, but some security experts recoiled at the notion that a researcher would actually take the same actions as a malicious hacker might to prove a point.", "url": "https://wpnews.pro/news/did-hacktron-s-openai-probe-go-too-far", "canonical_source": "https://www.thestack.technology/did-hacktrons-openai-probe-go-too-far/", "published_at": "2026-09-21 21:43:46+00:00", "updated_at": "2026-09-21 21:53:38.148977+00:00", "lang": "en", "topics": ["ai-safety", "ai-policy", "large-language-models"], "entities": ["Hacktron", "OpenAI", "Anthropic", "Claude Opus 5", "libheif", "Discourse", "Codex", "GitHub"], "alternates": {"html": "https://wpnews.pro/news/did-hacktron-s-openai-probe-go-too-far", "markdown": "https://wpnews.pro/news/did-hacktron-s-openai-probe-go-too-far.md", "text": "https://wpnews.pro/news/did-hacktron-s-openai-probe-go-too-far.txt", "jsonld": "https://wpnews.pro/news/did-hacktron-s-openai-probe-go-too-far.jsonld"}}