Time from initial bug discovery to internal repo access: Under 72 hours (Source: Hacktron research, reported by VentureBeat (Sept 27, 2026))
A Forum Bug Became a Path to Repo Access
Security researchers at Hacktron traced a chain of vulnerabilities from OpenAI's public community forum to a proof-of-concept pull request inside OpenAI's internal GitHub monorepo — the single repository holding code for multiple internal projects. Because the forum supported sign-in with an OpenAI account, the researchers reasoned that compromising it could open a path into broader OpenAI services. They found a remote code execution vulnerability in the image-upload pipeline of Discourse, the forum software OpenAI uses, and combined it with a separate misconfiguration in OpenAI's single sign-on infrastructure to take over the ChatGPT and Codex accounts of employees who had logged into the forum. One of those employees had a Codex environment connected to OpenAI's GitHub organization.
The researchers used that access to open a single, harmless proof-of-concept pull request in the internal monorepo, then stopped short of reading any OpenAI source code or testing how much further they could go. In their own account, they noted that because employees can connect services such as GitHub, Slack and email to Codex and ChatGPT, the theoretical scope of what they could have accessed was large — but they did not attempt to access those systems or the underlying codebase.
The AI Coding Agent Did the Fast Part
Hacktron used Anthropic's Claude models throughout the exploit chain. After the Opus 4.8 model struggled to make an exploit reliable, the researchers used the newly released Opus 5 to confirm that local remote code execution was possible through an image upload. They then placed Claude in an autonomous goal loop against their own Discourse Cloud test instance as a capture-the-flag exercise, after the model had initially refused to write an exploit chain aimed at a remote instance. Running on its own, the model reached remote code execution against the test instance; the researchers then reproduced the result against OpenAI's live instance on July 25.
Disclosure Moved Faster Than the Access Did
Hacktron reported the issue to both OpenAI and Discourse. OpenAI confirmed the underlying issue had been fixed roughly 14 hours after the initial submission — faster than the nearly three days it took the researchers to go from first bug to repository access. OpenAI did not respond to VentureBeat's request for comment by publication time.
Why the Access Mattered More Than the Bug
Independent analyst Carmi Levy called the incident "something of a warning shot" for the industry: monorepos consolidate development resources, but when a single identity holds broad access across one, that identity becomes what he termed a "monolithic target." Erik Avakian, a technical counselor at Info-Tech Research Group and former CISO for the Commonwealth of Pennsylvania, said monorepos are not inherently risky — the issue is concentration. AI coding agents raise the stakes because they are built to search code and map relationships between components faster than a person could, so the same speed that makes them useful to developers also benefits an attacker who inherits an agent's access. Avakian noted that some mitigating controls already exist: GitHub Apps can be scoped to selected repositories and use installation tokens with short lifespans, though those permissions still apply at the repository level and don't create separate boundaries between directories inside a single monorepo.
What Budget-Holders Should Ask Their Team
Avakian's recommendation to security leaders was to start not with the agent but with the credential: identify which credential a coding agent runs under — an employee OAuth token, a GitHub App, a service account, a personal access token, or an SSH key — and map what that credential can actually reach. Organizations that have adopted AI coding agents can ask their engineering teams directly: which credential does each coding agent use, can that credential create pull requests, modify workflows, or access secrets, does it reach any connected systems beyond the code repository itself, and would a single compromised account be contained to one project or able to reach the entire monorepo.
