Flaws in artificial intelligence accounts expose internal corporate tools

Connecting workplace software to artificial intelligence assistants can expose corporate systems to external takeovers, as demonstrated in a recent breach of employee accounts at OpenAI.

When engineers connect artificial intelligence tools to their daily workflow, they typically view the software as a helpful digital assistant that speeds up routine tasks. Modern conversational platforms and automated coding assistants frequently link directly to corporate communication channels, email inboxes, and version control repositories. That connectivity speeds up programming and administrative chores, yet it quietly links everyday workplace permissions to web-based account portals. If an outsider manages to hijack one of those accounts, the reach of the intrusion extends far beyond past chat logs.

The risk stems from how software applications maintain authorization across different corporate services. A user signs into an artificial intelligence tool, authorizes connections to workplace platforms, and relies on background security tokens to pass instructions back and forth. A flaw in that central identity framework can allow an unauthorized visitor to adopt the user identity entirely. When that occurs, every privilege granted to the assistant becomes available to the intruder, turning a single compromised portal into an entry point for proprietary documents, private communications, and production code.

That vulnerability path became a documented reality when an independent security researcher known as s1r1us reported that a three-person research team breached OpenAI on July 25, 2026.¹ The researchers exploited two software bugs to seize ChatGPT and Codex accounts belonging to OpenAI employees as well as some unaffiliated users.¹ Operating with an artificial intelligence model developed by Anthropic on a minimal budget, the team used the hijacked accounts to reach connected enterprise services and placed an unauthorized pull request into OpenAI's internal codebase, finishing the entire demonstration in under 72 hours.¹

How can an assistant account compromise workplace tools?

Compromising an artificial intelligence assistant exposes broader workplace tools because modern developer platforms store shared authorization tokens that grant ongoing access to external corporate services. In typical workplace configurations, an employee authorizes an assistant to read software repositories, track project discussions, and inspect incoming mail. That permission relies on digital credentials known as session tokens, which are temporary cryptographic keys that verify an account identity without demanding a password for every interaction. An intruder who finds a way around the initial login barrier inherits those active keys.

Once those stored tokens are compromised, the boundary between an external web application and a company internal network begins to dissolve. An attacker holding valid credentials can issue commands through the assistant interface that appear entirely legitimate to connected platforms. The artificial intelligence service acts as an authorized proxy, translating user prompts into requests directed at private corporate infrastructure. Because the requests travel through officially connected channels, automated defense systems often treat the incoming activity as ordinary employee tasks.

What did the security researchers access during the breach?

The security researchers accessed employee accounts across OpenAI, reached connected internal applications, and placed an unauthorized pull request directly into the company's internal software codebase.¹ In a public account posted on September 18, 2026, s1r1us reported that the team seized control of ChatGPT and Codex profiles used by company staff alongside accounts belonging to some unaffiliated individuals.¹ Through those hijacked accounts, the researchers gained access to connected enterprise tools, including Microsoft Outlook email, Slack workplace communications, and GitHub software repositories.¹

To confirm the extent of their control, the group modified internal software records directly.¹ The researchers submitted a pull request, which is a formal submission proposing modifications to computer programming files, into OpenAI's private code repositories.¹ The three independent researchers, who have an established history of testing corporate software boundaries and participating in lawful bug bounty programs, carried out the infiltration using an Anthropic artificial intelligence model on a shoestring budget, finishing the work in less than 72 hours.¹

What does the intrusion leave unanswered?

The public disclosure leaves the precise technical architecture of the two underlying bugs and the full roster of affected external accounts unexplained.¹ The public statement is an initial security notification. It does not provide a detailed post-incident audit or a full technical postmortem. It does not explain the specific coding errors that allowed account takeover, nor does it quantify the exact number of unaffiliated users whose profiles were compromised alongside OpenAI personnel.¹ Furthermore, the summary does not specify what technical safeguards or patch schedules OpenAI enacted following the July 25 intrusion.¹

The episode demonstrates the operational risks created when autonomous coding tools and conversational agents gain persistent hooks into sensitive corporate systems. In traditional software security, defenses focus on firewalls, password management, and network segregation. When staff link cloud-hosted artificial intelligence tools directly into communication and code infrastructure, those external platforms become attractive targets for lateral movement. A flaw in an external software provider can quickly compromise internal development environments.

Moving forward, technology companies will need to re-examine the scope of privileges granted to third-party artificial intelligence assistants. Organizations may restrict connected services to read-only states, mandate frequent re-authorization for repository access, or isolate internal development infrastructure from general web-facing accounts. As independent researchers continue probing these systems through lawful reward programs, the demonstration shows that automated tools can uncover critical configuration flaws rapidly and at minimal financial cost.¹

What this rests on

13 sentences trace to 1 source.

All 1Documents 1Records 0Reporting 0People 0

1. 1 H https://x.com/MikeIsaac Document · x.com · 18 Sep 2026 Researchers Using Anthropic Model Breached OpenAI by Exploiting Two Bugs See the source