[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-researchers-chained-two-bugs-to-reach-openais-internal-code":10,"sections":44},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":34,"tags":35,"sources":39,"feedback":43,"feedback_at":22,"cost_usd":43,"total_tokens":43},7035,"researchers-chained-two-bugs-to-reach-openais-internal-code","Researchers Chained Two Bugs to Reach OpenAI's Internal Code","Using Claude to chain a single sign-on flaw with an unspecified second bug, three researchers reached OpenAI staff accounts and code before a 14-hour patch.","Three researchers used Claude to break into OpenAI's internal systems, and OpenAI paid them for it.\n\nHacktron AI's team chained two separate weaknesses to reach OpenAI employee accounts and an internal code repository, all within 72 hours. One of the two flaws was a single sign-on vulnerability; the source material doesn't specify what the second one was. Neither flaw was an AI vulnerability itself - Claude reportedly helped the researchers work faster, not exploit anything unique to how AI systems behave. The team disclosed privately, OpenAI patched the SSO flaw in about 14 hours, and paid out a $6,500 bounty.\n\nThat speed is the real story here. A company as scrutinized as OpenAI closing a hole into employee accounts and source code in under a day suggests either a well-drilled incident response process or a flaw simple enough to patch fast - possibly both.\n\n$6,500 buys a lot of goodwill for OpenAI, and a lot less than what that access would fetch on the open market.","[\"security\",\"openai\",\"anthropic\",\"bug-bounty\"]","2026-09-19T06:27:52.000Z","2026-09-19T08:44:09.996Z","2026-09-19T08:44:21.912Z","published",null,[24,30],{"id":25,"reviewer":26,"round":27,"reason":28,"status":29},"editor-r1","editor",1,"Cut or soften the closing paragraph's leap from this single incident to a broad claim that 'bug bounty pricing has not caught up' with AI-assisted research finding things 'in days instead of months' — the source supports one case, not an industry-wide pricing trend, so this reads as unsupported speculation rather than grounded analysis.","resolved",{"id":31,"reviewer":26,"round":32,"reason":33,"status":29},"editor-r2",2,"The source only confirms one flaw was single sign-on\u002Fauthentication and never specifies the nature of the second flaw, so drop or hedge the claim that both were 'authentication and access control' since that's unsupported by the source material.","security",[34,36,37,38],"openai","anthropic","bug-bounty",[40],{"name":41,"url":42},"The Next Web","https:\u002F\u002Fthenextweb.com\u002Fnews\u002Fhacktron-claude-openai-bug-bounty-6500-guardrails-paper",0,{"sections":45},[46,51,55,60,65,70,75,80,85,90,95,100,105,110],{"name":47,"slug":48,"count":49,"latest_published_at":50},"AI","ai",4114,"2026-09-19T18:33:46.000Z",{"name":52,"slug":34,"count":53,"latest_published_at":54},"Security",673,"2026-09-19T17:30:00.000Z",{"name":56,"slug":57,"count":58,"latest_published_at":59},"Policy","policy",345,"2026-09-19T19:22:20.000Z",{"name":61,"slug":62,"count":63,"latest_published_at":64},"Deals","deals",179,"2026-06-29T20:02:07.000Z",{"name":66,"slug":67,"count":68,"latest_published_at":69},"Hardware","hardware",156,"2026-09-19T11:00:00.000Z",{"name":71,"slug":72,"count":73,"latest_published_at":74},"Science","science",129,"2026-09-19T19:45:00.000Z",{"name":76,"slug":77,"count":78,"latest_published_at":79},"Consumer Tech","consumer-tech",99,"2026-09-09T17:27:33.000Z",{"name":81,"slug":82,"count":83,"latest_published_at":84},"Dev Tools","dev-tools",78,"2026-09-18T04:00:00.000Z",{"name":86,"slug":87,"count":88,"latest_published_at":89},"Software","software",75,"2026-09-10T20:41:21.000Z",{"name":91,"slug":92,"count":93,"latest_published_at":94},"Startups","startups",55,"2026-09-09T23:14:29.000Z",{"name":96,"slug":97,"count":98,"latest_published_at":99},"Gaming","gaming",43,"2026-09-10T12:18:06.000Z",{"name":101,"slug":102,"count":103,"latest_published_at":104},"General","general",42,"2026-09-18T22:35:10.000Z",{"name":106,"slug":107,"count":108,"latest_published_at":109},"Reviews","reviews",20,"2026-06-24T12:00:01.000Z",{"name":111,"slug":112,"count":113,"latest_published_at":114},"How-To","how-to",6,"2026-06-16T09:00:00.000Z"]