An OpenAI breach shows the reach of connected accounts
Researchers describe a July intrusion that reached employee accounts and an internal repository. What was fixed, what remains unproven, and why connected access matters.
The important part of today's OpenAI security story is how far a compromised account could reach. Researchers at Hacktron describe taking over employee ChatGPT accounts and using a connected coding assistant to demonstrate access to an internal repository. It is a concrete example of why connecting an assistant to more services changes the consequences of losing control of a login.
The incident happened on July 25, according to Hacktron's technical account, whose page is dated September 13. Today's coverage is not evidence of a new intrusion. The researchers say an image-processing vulnerability in OpenAI's community forum, combined with a separate sign-in flaw, gave them access to ChatGPT and Codex accounts. They demonstrated the impact with a test pull request, said they avoided reading internal code, and stopped testing. Their timeline says OpenAI confirmed its fix later that day.
TechCrunch's September 18 report says OpenAI considers the issues resolved. The researchers' detailed account remains their own account, from a commercial security firm; we have not reproduced the findings. It does not establish that all ChatGPT users were compromised or that customer conversations were stolen.
There is also a separate, checkable record for the forum component. Discourse's July 28 advisory confirms an image-upload vulnerability, identifies patched releases, and describes additional image-processing isolation. Forum administrators should consult that maintained advisory for their installation. A fix to this component and a fix to OpenAI's sign-in system address different parts of the reported chain.
For everyone using connected AI tools, the useful next step is an access review. EFF's privacy guide recommends taking stock of integrations and revoking unwanted access. Check which assistants can reach your files, messages, and repositories; remove connections you no longer need. Ask what information would become accessible if the account were compromised. Those habits reduce unnecessary exposure, but cannot substitute for a provider securing its own infrastructure.
Our view: the industry cannot make the safety debate only about model behavior. Identity systems, third-party software, and connected services matter too. We want useful assistants, and we want companies to demonstrate that access is contained, incidents are investigated, and independent scrutiny can test their assurances. A reported fix is welcome. It is not a reason to stop asking how the failure became possible.