Seventy-Two Hours and a Malformed Image
An authorized bug bounty ran from a malformed image upload to write access on OpenAI's internal repositories in under seventy-two hours, and the exploit work that had stalled on one model version came together in three hours on the next one. That's the tension today: defenders got faster, attackers got cheaper, and only one company on the internet noticed the traffic.
Hacktron's write-up of the OpenAI engagement — a heap overflow in libheif, reached because Discourse hands unsupported image formats to ImageMagick, escalated through single sign-on into an employee's Codex. Confirmed GitHub…
The skinny
The skinny isn't ready yet — notes appear once the transcript is processed.