conv.

All stories
SecurityQuiet 6d · day 6

Hacktron researchers breach OpenAI, exposing employee account vulnerabilities

White-hat hackers chained two flaws to access employee ChatGPT accounts; OpenAI has patched the holes.

newest coverage 5d agosummary written 5d ago4 pieces7 likes & upvotes2 comments NewswiresBlueskyGoogle News

What to know

  • Hacktron researchers breached OpenAI in July by chaining two unknown vulnerabilities in Discourse and OpenAI's employee validation system to access employee ChatGPT accounts, demonstrating a white-hat proof-of-concept that caused no damage.
  • OpenAI has patched both vulnerabilities and paid Hacktron $6,500 through its bug bounty program for responsible disclosure.
  • Security experts warn the vulnerability chain mirrors tactics used by nation-state-backed hackers, raising concerns about industrial espionage and AI model theft in a highly competitive field.
  • The breach disclosure intensifies a wave of AI safety and security concerns, as safety researchers have recently resigned from major companies and called for stronger safeguards.

“The hack conducted demonstrates the need for constant vigilance in these environments and when there's so many moving parts and the pressure to constantly develop and be delivering; patches get neglected, configurations get missed and cracks in layers of security get exposed”

Greg Linares, Cybersecurity researcher, Persona · NBC News ↗

Hacktron Cybersecurity research firmOpenAI AI companyGreg Linares Cybersecurity researcher, Persona

Hacktron researchers breach OpenAI, exposing employee account vulnerabilities
nbcnews.com

How it unfolded 2 developments, newest first · click a bar or a number to jump articlesposts

Peak 1 piece in two hours at Sep 17, 11 PM; 4 pieces over 6 days (3 articles · 1 post) Sep 17, 11 PM — 1 piece · 1 article — Newswires 1Sep 18, 1 AM — quietSep 18, 3 AM — quietSep 18, 5 AM — quietSep 18, 7 AM — quietSep 18, 9 AM — 1 piece · 1 article — Google News 1Sep 18, 11 AM — quietSep 18, 1 PM — 1 piece · 1 article — Newswires 1Sep 18, 3 PM — quietSep 18, 5 PM — 1 piece · 1 post — Bluesky 1Sep 18, 7 PM — quietSep 18, 9 PM — quietSep 18, 11 PM — quietSep 19, 1 AM — quietSep 19, 3 AM — quietSep 19, 5 AM — quietSep 19, 7 AM — quietSep 19, 9 AM — quietSep 19, 11 AM — quietSep 19, 1 PM — quietSep 19, 3 PM — quietSep 19, 5 PM — quietSep 19, 7 PM — quietSep 19, 9 PM — quietSep 19, 11 PM — quietSep 20, 1 AM — quietSep 20, 3 AM — quietSep 20, 5 AM — quietSep 20, 7 AM — quietSep 20, 9 AM — quietSep 20, 11 AM — quietSep 20, 1 PM — quietSep 20, 3 PM — quietSep 20, 5 PM — quietSep 20, 7 PM — quietSep 20, 9 PM — quietSep 20, 11 PM — quietSep 21, 1 AM — quietSep 21, 3 AM — quietSep 21, 5 AM — quietSep 21, 7 AM — quietSep 21, 9 AM — quietSep 21, 11 AM — quietSep 21, 1 PM — quietSep 21, 3 PM — quietSep 21, 5 PM — quietSep 21, 7 PM — quietSep 21, 9 PM — quietSep 21, 11 PM — quietSep 22, 1 AM — quietSep 22, 3 AM — quietSep 22, 5 AM — quietSep 22, 7 AM — quietSep 22, 9 AM — quietSep 22, 11 AM — quietSep 22, 1 PM — quietSep 22, 3 PM — quietSep 22, 5 PM — quietSep 22, 7 PM — quietSep 22, 9 PM — quietSep 22, 11 PM — quietYesterday, 1 AM — quietYesterday, 3 AM — quietYesterday, 5 AM — quietYesterday, 7 AM — quietYesterday, 9 AM — quietYesterday, 11 AM — quietYesterday, 1 PM — quietYesterday, 3 PM — quietYesterday, 5 PM — quietYesterday, 7 PM — quietYesterday, 9 PM — quietYesterday, 11 PM — quietToday, 1 AM — quietToday, 3 AM — quietToday, 5 AM — quietToday, 7 AM — quiet 1–2
Sep 18Sep 19Sep 20Sep 21Sep 22yesterdaynow · 9:44 AM ET
  1. 1

    Security expert warns vulnerability type matches nation-state tactics

    Greg Linares, a cybersecurity researcher at Persona, tells NBC News that the vulnerability chain Hacktron exploited mirrors techniques used by advanced persistent threats and nation-state-backed hackers. He emphasizes the need for constant vigilance as AI companies balance rapid development with security.

    “What they chained together was not untypical from what very high-level real-world attackers, such as APTs or nation-state-backed hackers, would use to compromise targets…”
    — Greg Linares
    1. 1 outlet Hackers breached OpenAI, adding to fever pitch of security and safety concerns

      first by NBC News, 5d ago

  2. 2

    NBC News reports on Hacktron breach and OpenAI response

    NBC News covers the Hacktron announcement. OpenAI spokesperson confirms the breach, states vulnerabilities have been patched, and thanks the researchers for responsible disclosure. OpenAI paid $6,500 through its bug bounty program.

    “We thank the researchers for contacting us and sharing their findings…”
    — OpenAI spokesperson
  3. background

    Hacktron announces the breach publicly — The researchers disclosed their findings in a blog post, revealing how they chained together the two vulnerabilities. This marked the first public disclosure of the security gaps.

  4. background

    Hacktron conducts 72-hour breach of OpenAI systems — Researchers at cybersecurity firm Hacktron exploited two unknown vulnerabilities—one in Discourse and one in OpenAI's employee validation system—to access employee ChatGPT accounts. The operation occurred in late July and caused no harm to OpenAI's systems.