The Flux Read

In late July, three security researchers at a small firm called Hacktron spent 72 hours doing something that should honestly embarrass a company with OpenAI's massive resources. They took over internal employee ChatGPT and Codex accounts, reached private code repositories, and proved it by quietly merging a pull request directly into OpenAI's own codebase. The most fascinating part? They didn’t use some high-end, custom-built hacking framework. They built the exploit using Claude. OpenAI paid them a $6,500 bounty for the discovery. As it turns out, the underlying bug had been sitting there quietly for over a year. Where the chain actually started The initial breach didn't touch OpenAI's core infrastructure at all. It began at community.openai.com -  their public discourse forum, built on third-party software called Discourse. When users upload images to Discourse, the platform passes the processing job to a background library called libheif via ImageMagick. Buried deep...