conv.

← The whole story
Security
Claude-Built Exploit Chained With Sign-In Flaw to Access OpenAI Code Repos

OpenAI confirms fix and pays bug bounty; Discourse follows within two days

1 Sep 18 · 6d ago · 1 article · 1 source · development 1 of 2

OpenAI confirmed a fix for the account-takeover flaw about 14 hours after Hacktron reported it through Bugcrowd and paid a $6,500 bounty. Discourse separately patched the libheif flaw within two days and added image-processing sandboxing as defense.

OpenAI confirms fix and pays bug bounty; Discourse follows within two days
SecurityWeek

“We thank the researchers for contacting us and sharing their findings. We narrowed the permissions on Community sign-in tokens and revoked affected tokens and sessions.”

OpenAI · rss ↗

Hacktron Security research firmOpenAI Target and respondentDiscourse Third-party forum platform

The whole story articles the bright band is this development · numbered dots are the others · click one to jump

Peak 1 piece in two hours at Sep 17, 11 PM; 2 pieces over 6 days (2 articles) Sep 17, 11 PM — 1 piece · 1 article — Newswires 1Sep 18, 1 AM — quietSep 18, 3 AM — quietSep 18, 5 AM — quietSep 18, 7 AM — 1 piece · 1 article — Newswires 1Sep 18, 9 AM — quietSep 18, 11 AM — quietSep 18, 1 PM — quietSep 18, 3 PM — quietSep 18, 5 PM — quietSep 18, 7 PM — quietSep 18, 9 PM — quietSep 18, 11 PM — quietSep 19, 1 AM — quietSep 19, 3 AM — quietSep 19, 5 AM — quietSep 19, 7 AM — quietSep 19, 9 AM — quietSep 19, 11 AM — quietSep 19, 1 PM — quietSep 19, 3 PM — quietSep 19, 5 PM — quietSep 19, 7 PM — quietSep 19, 9 PM — quietSep 19, 11 PM — quietSep 20, 1 AM — quietSep 20, 3 AM — quietSep 20, 5 AM — quietSep 20, 7 AM — quietSep 20, 9 AM — quietSep 20, 11 AM — quietSep 20, 1 PM — quietSep 20, 3 PM — quietSep 20, 5 PM — quietSep 20, 7 PM — quietSep 20, 9 PM — quietSep 20, 11 PM — quietSep 21, 1 AM — quietSep 21, 3 AM — quietSep 21, 5 AM — quietSep 21, 7 AM — quietSep 21, 9 AM — quietSep 21, 11 AM — quietSep 21, 1 PM — quietSep 21, 3 PM — quietSep 21, 5 PM — quietSep 21, 7 PM — quietSep 21, 9 PM — quietSep 21, 11 PM — quietSep 22, 1 AM — quietSep 22, 3 AM — quietSep 22, 5 AM — quietSep 22, 7 AM — quietSep 22, 9 AM — quietSep 22, 11 AM — quietSep 22, 1 PM — quietSep 22, 3 PM — quietSep 22, 5 PM — quietSep 22, 7 PM — quietSep 22, 9 PM — quietSep 22, 11 PM — quietYesterday, 1 AM — quietYesterday, 3 AM — quietYesterday, 5 AM — quietYesterday, 7 AM — quietYesterday, 9 AM — quietYesterday, 11 AM — quietYesterday, 1 PM — quietYesterday, 3 PM — quietYesterday, 5 PM — quietYesterday, 7 PM — quietYesterday, 9 PM — quietYesterday, 11 PM — quietToday, 1 AM — quietToday, 3 AM — quietToday, 5 AM — quietToday, 7 AM — quiet 1–2
1–2OpenAI confirms fix and pays bug bounty…
Sep 18Sep 19Sep 20Sep 21Sep 22yesterdaynow · 9:46 AM ET

Reported in the same hours no headline names this development itself — these 1 claim were published in its stretch

  1. 1 outlet AI-Built Exploit and Sign-In Flaw Opened Path to Internal OpenAI Code

    first by SecurityWeek, 6d ago

All 2 developments of Claude-Built Exploit Chained With Sign-In Flaw to Access… →

Newswires