Staff spent years warning that OpenAI's shared code repository exposed too much, and a researcher breach showed how fast an outsider could get in
OpenAI keeps much of its code in one enormous shared repository. For years, employees warned that this setup let anyone with code access peek at projects far outside their own job.
Those warnings did not lead to a fix in time. In 2026, outside security researchers showed the same repository could be reached from a weak point on the company’s community forum, and they did it in under 72 hours.
One keycard, every floor
At OpenAI, that meant staff with code access could view details of many projects unrelated to their roles. Current and former employees repeatedly flagged this as a risk, arguing that loose internal controls could expose sensitive work to people who had no business seeing it.
The complaints are not new. Employees raised security concerns with leadership before ChatGPT launched in November 2022. According to those staff accounts, management seemed more focused on shipping quickly than on locking things down.
How Hacktron got inside
The warnings became concrete when researchers from security firm Hacktron went looking for holes. On July 25, 2026, they exploited a vulnerability in OpenAI’s community forum.
That flaw gave them remote code execution, meaning they could run their own commands on OpenAI’s systems. From there, they reached the internal code repository in under 72 hours.
The key ingredient was an SSO misconfiguration. Single sign-on is the system that lets one login unlock many internal tools. Configure it badly, and a foothold in a minor service can turn into access to something far more valuable.
Hacktron disclosed the issue responsibly, and the case involved a proof-of-concept pull request numbered #1186742. A pull request is a proposed code change, so its existence signals the researchers could do more than simply read files.
OpenAI paid Hacktron a $6,500 bug bounty for the report.
The company responded by revising its security setup. Changes included narrowing token permissions. Tokens are digital keys that grant software and users specific access rights, and narrowing them means each key now opens fewer doors.
Security researchers from Hacktron reported the incident publicly in September 2026.
A quarter of engineers pointed at the problem
OpenAI had already begun shifting resources before the Hacktron findings went public. In August 2026, senior executive Thibault Sottiaux announced that 25% of the company’s production engineers would be redirected toward strengthening security infrastructure.
OpenAI maintains that its most confidential work sits in separate repositories, outside the shared monorepo. In other words, the company argues the most sensitive material was never behind the same door everyone could open.
That defense matters, but it does not fully answer the original complaint. Employees were not only worried about the most secret projects. They were worried about broad, casual access to work unrelated to their roles.
Why this matters beyond one breach
Concerns raised before late 2022 were still relevant in 2026, and the eventual proof came from outsiders rather than an internal audit.
There is also a newer pressure on the horizon. AI-enabled coding tools are increasing vulnerability exposure, letting attackers and researchers alike probe systems faster than before.
For OpenAI, the stakes are partly about protecting its own intellectual property. Model research, product plans and infrastructure code are the core of its competitive position, and broad internal access raises the risk of leaks, whether accidental or deliberate.
