After spending billions, OpenAI still has gaps in its cybersecurity

Summary

Hacktron researchers chained two critical vulnerabilities, starting with a flaw in an image processing library that enabled remote code execution, to compromise multiple OpenAI employees' ChatGPT accounts and reach internal repositories. Separately, Accomplish researchers found two ways out of the OpenAI Codex sandbox, reported on August 12, 2026, and fixed within eight days.

Mitigation

The vulnerabilities were fixed after reporting under a coordinated disclosure program. Dubey advised that enterprises should not rely on sandboxing as a standalone control and should add controls to secure the larger system if a sandbox is compromised.

Related items

• InfoJim Cramer has three lingering questions about Anthropic ahead of its historic IPOSame vendor · CNBC Technology
• MediumGHSA-68g8-gh8f-7rhg: pgEdge RAG Server discloses part of the configured provider credential through API error messagesSame vendor · GitHub Advisory Database
• InfoHow Amplitude ships product improvements in 1–2 days with OpenAISame vendor · OpenAI Blog
• InfoEndor Labs + OpenAI: Strengthening the Defense Factory With Accelerated Remediation | Endor LabsSame vendor · Endor Labs Blog
• InfoJensen Huang built an AI kingdom. Now he’s gone, will Nvidia’s ramparts be breached?Same vendor · The Guardian Technology