Security researchers say they reached OpenAI’s internal GitHub monorepo in under 72 hours, demonstrating how a stolen employee identity can turn an AI coding environment into a high-value path through a company’s software infrastructure.
Hacktron’s research report describes a chain that began with OpenAI’s Discourse-based community forum and ended with the researchers opening a harmless proof-of-concept pull request in the company’s internal monorepo. The researchers said they did not read source code or test how far they could proceed after reaching the repository.
The significance extends beyond one vulnerable forum or one company. Coding agents are designed to navigate repositories, identify dependencies, understand how components fit together and make changes across projects. When those systems operate through employee accounts with broad permissions, compromising the account can provide an attacker with capabilities that would otherwise require extensive manual reconnaissance.
A three-part chain
Hacktron said it started by examining OpenAI’s community forum, which supported “Sign in with OpenAI.” The forum used an image upload pipeline that could be exploited through a vulnerability in the libheif image-processing library. During a controlled capture-the-flag exercise, the researchers used Anthropic’s Claude models to help make the exploit reliable.
The underlying issue is documented in Discourse’s security advisory for the malformed HEIF vulnerability. The advisory describes remote code execution through image uploads, identifies the vulnerability as CVE-2026-32882 and lists the affected and patched Discourse versions. It also credits Hacktron researchers for reporting the issue.
Hacktron said it achieved remote code execution on OpenAI’s forum instance on July 25. That access alone did not provide a direct route to the monorepo. The next step involved a separate configuration weakness in OpenAI’s single-sign-on infrastructure.
According to the researchers, the compromised forum could be used to take over ChatGPT and Codex accounts belonging to users who had logged into the forum. That expanded the impact from a vulnerable web application to the identities connected to it. Among those accounts was an OpenAI employee account with a Codex environment connected to the company’s GitHub organization.
The researchers then used that environment to reach OpenAI’s internal monorepo and open a pull request. The action was intentionally limited, serving as evidence that the account and its connected development tools could interact with the repository.
OpenAI reportedly fixed the issue about 14 hours after receiving Hacktron’s report. The research group said it stopped after creating the proof of concept, rather than examining the repository or attempting additional actions.
Why the monorepo raises the stakes
A monorepo is a development strategy as much as a technical structure. By placing multiple projects and shared components in one repository, companies can centralize dependencies, standardize tooling and make it easier for engineering teams to reuse code. For AI coding agents, that concentration can improve context and make automated work more effective.
The same structure can increase the value of a compromised identity. An agent connected to a large repository may be able to locate relevant code quickly, follow relationships between services and prepare changes across boundaries that would be difficult for a human attacker to map manually. If the identity also has access to build systems, secrets or deployment workflows, the repository becomes a control point rather than simply a store of source code.
That creates a competitive tradeoff for companies deploying agentic development tools. The more access an agent receives, the more useful it becomes to engineering teams. The more persistent and broad that access is, however, the greater the potential damage when credentials are stolen or an account is hijacked.
For OpenAI, the incident is especially notable because the company is both a leading developer of coding agents and a major target for attempts to obtain proprietary software, model infrastructure and internal development processes. Anthropic’s Claude was used by the researchers to improve the exploit, while OpenAI’s own Codex environment became the mechanism through which the final repository access was demonstrated. The episode shows that competition between model providers does not eliminate shared security risks. Tools from one provider can help attack the infrastructure used by another.
The access model becomes the product risk
The central lesson is not that AI agents are inherently untrustworthy. It is that their usefulness depends on the permissions, credentials and connectors surrounding them.
Enterprises adopting these systems should separate read and write privileges, limit agents to specific repositories and use short-lived identities that can be revoked quickly. Security teams also need to determine whether an agent can reach secrets, continuous integration workflows, deployment systems or external services beyond the task it was assigned.
The Hacktron case turns those recommendations into an operational issue. An attacker did not need to defeat the coding agent itself. The attacker needed to compromise an identity that already controlled the agent. As companies treat repository access and automated code changes as productivity advantages, identity containment will determine whether those advantages become durable competitive assets or concentrated liabilities.
- Coolcaesar · CC BY 4.0
This article was generated using AI and published automatically without human pre-publication review.
How this article was made
The article was produced by the Grandmonts Media News Engine using automated research, drafting and verification workflows. No human editor reviewed the article before publication. Grandmonts Media remains responsible for the published content. Errors can be reported at office@grandmonts.cz.