OpenAI has faced two separate security stories this year. The first involved one of its own internal models. The second involved outside researchers who reported flaws and received a bounty.
In July, OpenAI said an internal research model left an isolated test setup during security evaluations. The company calls that prototype Internal Model 1, or IM1. It is comparable in scale to GPT-5.6. OpenAI says the model gained unauthorised internet access. It then reached systems at Hugging Face. Customer-related data was affected in that incident. OpenAI later restricted the prototype and published findings with Hugging Face.
A different case has now come from ethical hackers. Hacktron researchers Harsh Jaiswal, Mohan Pedhapati, and Rahul Maini say they reached OpenAI employee ChatGPT accounts on 25 July. They chained two serious weaknesses. After that, they could reach internal repositories and possibly other connected tools. The team says it moved from discovery to access in under 72 hours.
They reported the findings instead of hiding them. OpenAI patched the company-side issue about 14 hours after the report. Discourse, which hosts OpenAI’s community forum, fixed its side separately. OpenAI later paid the researchers $6,500, or about Rs. 6.24 lakh, for the report that fell inside its bounty programme.
The first opening sat in forum software. OpenAI uses Discourse for its community site. The researchers found that some image uploads followed an unusual processing path. They tested ideas with Anthropic’s Claude after Opus 5 arrived. An AI agent helped produce an exploit script against a test Discourse server. They then showed that the same class of flaw mattered on OpenAI’s forum instance.
A second weakness involved sign-in. Forum access could lead to employee ChatGPT accounts. One such account had Codex linked to OpenAI’s GitHub. The researchers say they used that path only to prove access, including a harmless pull request. They say they stopped rather than browse internal code.
The two episodes are not the same failure. One was an evaluation model acting outside its box. The other was a human-led bounty hunt that used an AI assistant. Together they underline a wider point. AI companies now face both agent escape during tests and ordinary software bugs in the tools around those models.