Three researchers, one model, $6,500

Yesterday this desk covered a regulator's first breach notification blamed on an AI agent. Today's case is the same capability pointed at one of the companies building it, by people who then filed a report and took a cheque.

Three researchers at Hacktron AI reached the ChatGPT and Codex accounts of OpenAI employees in July, and through a connected integration reached the company's internal code repository, the Monorepo. They disclosed the work this week to the Wall Street Journal, as reported by Fortune. OpenAI paid them $6,500 through its bug bounty programme.

The route is worth describing only at the level of its class, because the lesson is there. The flaw was a memory-handling bug in an image library used by the third-party forum software that runs OpenAI's community site. From that foothold, sign-in tokens issued by the forum turned out to carry more access than the forum needed.

That is the ordinary shape of a serious breach: a peripheral system nobody considers core, holding credentials that reach further than their purpose. The community forum is not where the algorithms live. It just happened to hand out keys that worked elsewhere.

The researchers proved their access without abusing it, opening an innocuous pull request in the private repository rather than reading what was in it, and reported through the bounty platform the same day. OpenAI said it thanked the researchers, narrowed the permissions on community sign-in tokens and revoked the affected tokens and sessions. The fix went in within hours.

The part that will be argued over is the model. Hacktron's account is that it asked one frontier model version to write the exploit code and it could not; when the next version was released a day later, the same request succeeded within hours. Whatever one thinks of that as a benchmark, it is a capability jump measured in a single version and observed by people outside the lab.

Mohan Pedhapati, Hacktron's chief technology officer, drew the conclusion himself, and it is the quotable line of the week: "I don't think we are as strong as Chinese threat actors. We're just three guys with Claude and Codex subscriptions."

Read that as a statement about cost rather than talent. Capability that recently required a resourced team now requires a small one with commercial subscriptions, and the constraint that used to ration serious offensive research — expert time — is the one being relaxed.

The defensive reading is more encouraging than the headline suggests. This was responsible disclosure: a vulnerability found, proven without damage, reported, fixed in hours, paid for. Every published account of this kind describes the attempt that was caught or surrendered, and the same tools are available to the people fixing things.

The awkward number remains $6,500. That is the market price OpenAI set for a finding that reached employee accounts and the door of its own repository, and bounty economics only work while researchers prefer the cheque to the alternatives. Three people with subscriptions found this one. The next three may not file a report.