September 18, 2026
The Blast Radius of an Agent Account
Three researchers breached OpenAI's internal repository in 72 hours. The blast radius of an agent account is everything connected to it.
Three researchers at Hacktron AI broke into OpenAI's internal repository in under 72 hours. The proof of access was a pull request opened from an employee's account. "We're just three guys with Claude and Codex subscriptions," co-founder Mohan Pedhapati told the Wall Street Journal. OpenAI fixed the flaw about 14 hours after the report and paid a $6,500 bounty.
The chain began with an uploaded image that exploited a memory flaw in the community.openai.com forum, hosted on Discourse (not to be confused with Discord). It became remote code execution on the forum server. OpenAI's single sign-on, which the forum uses to authenticate, turned that access into access to employee accounts on ChatGPT and Codex. One of them had the organization's GitHub connected, and a prompt in that account opened the pull request in the openai/openai monorepo. The Claude used was the version cleared for cybersecurity work, with relaxed restrictions: Opus 4.8 failed, Opus 5 got it done.
The blast radius of an agent account is everything connected to it. The bounty program worked as it should, but the product decision comes first: if the account is stolen, how far can the agent reach? And should logging into one service open the door to another?
Sources: Fortune · Tom's Hardware · The Register · Hacktron AI