Indian Researchers Identify Security Vulnerabilities in OpenAI System
05 October, Kathmandu – Three cybersecurity researchers of Indian origin have discovered security vulnerabilities in OpenAI’s system by utilizing Anthropic’s AI model ‘Claude.’ They successfully exploited these weaknesses to gain control over some ChatGPT and Codex accounts belonging to OpenAI staff and demonstrated a potential path to access the company’s internal software repository. This was not a malicious cyberattack but an official security test conducted under OpenAI’s bug bounty program. After reporting the weaknesses to OpenAI, the company resolved the issues and awarded the researchers $6,500.
Who are the three researchers involved? The security test was conducted by Mohan Pedapati, Harsh Jayswal, and Rahul Mehni, researchers at the cybersecurity startup Hacktron AI. They began testing on July 25 and reportedly gained employee account access in less than 72 hours. Various reports indicate that their research cost under $3,000, including the use of AI tools. The investigation began by exploiting vulnerabilities in Discourse software used on OpenAI’s public community forum.
After gaining access to the forum server, the researchers found another vulnerability in OpenAI’s ‘Sign in with OpenAI’ system. This login method used for the community forum was connected to other services like ChatGPT and Codex. Due to a shared Single Sign-On (SSO) system, authentication tokens issued for forum login were also valid for other OpenAI services. These tokens function like digital credentials, allowing users to access services without entering passwords.
One employee Codex account controlled by the researchers was linked to OpenAI’s private GitHub group, revealing the possibility of accessing internal software repositories. However, the researchers did not read, modify, merge source code, or access customer data. They only created secure and harmless pull requests as evidence of their access. According to Hacktron, this level of access could have potentially posed risks to other systems such as Slack, email, and additional employee-linked services beyond GitHub.
OpenAI has addressed and fixed the vulnerability in their login system, revoked affected tokens and sessions, and implemented additional security controls on the shared login system. On September 1, OpenAI awarded Hacktron a $6,500 bug bounty. The company clarified that this payout was for the vulnerability found in its own identity and login system, not the Discourse platform flaw.
This incident raises two key questions about security systems at AI companies: First, why was internal employee account access exposed through vulnerabilities in an external public forum? Second, what risks remain when public and sensitive internal services are connected through a single SSO system, allowing compromise of one to extend access to others?