Researchers breach OpenAI employee accounts and bypass Codex sandbox

September 21, 2026 at 10:02 PM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

Researchers from Hacktron chained two vulnerabilities to compromise multiple OpenAI employee ChatGPT accounts and access internal repositories on July 25, 2026. Separately, Accomplish researchers bypassed sandbox controls in OpenAI's Codex agent and reported the flaws on August 12, 2026. Both sets of vulnerabilities were fixed after coordinated disclosure.

Key Facts

Hacktron researchers Harsh Jaiswal, Mohan Pedhapati and Rahul Maini chained two critical vulnerabilities on July 25, 2026 to compromise multiple OpenAI employee ChatGPT accounts.
The compromised accounts allowed access to internal OpenAI repositories and potentially other connectors.
Accomplish researchers reported two ways out of the OpenAI Codex sandbox to OpenAI on August 12, 2026.
Hacktron used Anthropic's Claude AI iteratively to refine the attack path, including reconnaissance, vulnerability analysis and exploit development.
Cybersecurity researcher Vibhum Dubey said the focus is shifting from an AI's vulnerability to being deceived to the degree to which the AI is allowed to act on that deception.

Employee Account Compromise

Hacktron chained two critical vulnerabilities to achieve remote code execution and gain access to OpenAI employee accounts and internal systems. The attack began with a flaw in an image processing library that enabled remote code execution. Initial access was used to extract authentication tokens, allowing movement across connected systems. The researchers demonstrated the access by performing a benign action using an employee account and did not exfiltrate sensitive data. The work was conducted under a coordinated disclosure program, and the vulnerabilities were fixed after reporting.

Codex Sandbox Escape

Accomplish researchers bypassed sandbox controls in OpenAI's Codex coding agent environment. The agent executed actions outside its intended scope and interacted with external systems despite restrictions designed to limit its behavior. The researchers found two ways out of the OpenAI Codex sandbox and reported both to OpenAI on August 12, 2026.

AI-Assisted Attack Shift

Hacktron used OpenAI rival Anthropic's Claude AI to help with the operation. The model was used iteratively to refine the attack path and improve the exploit chain, including in reconnaissance, vulnerability analysis and exploit development. Cybersecurity researcher Vibhum Dubey said the focus is moving from an AI's vulnerability to being deceived to the degree to which the AI is allowed to act on this deception. Dubey added that an autonomous agent can interpret instruction, call tools, write or run code, access files, and communicate with other systems, creating a much wider attack surface than a conventional chatbot. He said one minor vulnerability in such an agent can have disproportionately negative consequences due to the agent's potential to act autonomously and operate across multiple systems.