The Frontier · Tags
#hacktron
3 published articles
Hacktron's OpenAI bounty: Discourse RCE met an SSO bridge
A July chain on community.openai.com reached ChatGPT and Codex. OpenAI paid $6,500 for the identity finding. Discourse's HEIF advisory tells self-hosters to rebuild.
Claude hacked OpenAI
Hacktron used Claude models while building a forum-to-SSO chain. The bounty and advisory put the break on Discourse libheif plus an OpenAI SSO flaw. Claude is not cast as the attacking party.
Forum to SSO to Codex: where OpenAI's identity boundary broke
Hacktron's July 2026 chain turned a Discourse image-upload bug into ChatGPT and Codex session access. The advisory and the bounty note separate the forum RCE from the SSO finding.