Hacktron used Claude to chain OpenAI forum RCE into employee ChatGPT sessions
Hacktron chained a Discourse HEIF RCE with an OpenAI SSO flaw to reach employee ChatGPT and Codex sessions in under 72 hours. OpenAI paid $6,500 for the identity-side finding.