‹ BackHN Continuity

Thread

A heap overflow and SSO misconfiguration to compromise OpenAI internal repos

491 points · 208 comments · Handy-Man

  1. lukeify · · focus · HN ↗
    A $6500 bounty is insulting.
    1. xnickb · · focus · HN ↗
      > Until two months ago, any user or OpenAI employee logging into OpenAI’s own help forum (community.openai.com) could have had their ChatGPT and Codex accounts taken over.

      Hey, it's their call to decide the value of their entire user base.

    2. konchunas · · focus · HN ↗
      It is a signal for next hackers who get into OpenAI servers to not even consider going the whitehat route
Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.