Thread

A heap overflow and SSO misconfiguration to compromise OpenAI internal repos

491 points · 208 comments · Handy-Man

lukeify · 1789715484 · focus · HN ↗
A $6500 bounty is insulting.
1. xnickb · 1789718430 · focus · HN ↗
  > Until two months ago, any user or OpenAI employee logging into OpenAI’s own help forum (community.openai.com) could have had their ChatGPT and Codex accounts taken over.
  Hey, it's their call to decide the value of their entire user base.

Unofficial Hacker News client; not affiliated with Y Combinator.