Hacking OpenAI

On July 25, 2026, security researchers chained two critical vulnerabilities to compromise multiple OpenAI employees' ChatGPT accounts, gaining access to internal repositories and connected services like GitHub and Slack. The exploit leveraged a heap buffer overflow in the libheif image decoder and an OpenAI SSO identity flaw on the community.openai.com forum, which was patched by OpenAI within 14 hours of disclosure. OpenAI awarded a $6,500 bounty for the responsible disclosure, which was completed in under 72 hours.