After spending billions, OpenAI still has gaps in its cybersecurity

Two separate reports of security flaws in OpenAI systems highlight how even a company spending billions on developing its own AI-powered cybersecurity testing tools remains vulnerable.

In one incident, researchers breached OpenAI systems with the help of a rival AI developer’s tools, while another group of researchers tricked OpenAI’s Codex agent into bypassing its sandbox controls.

Researchers from Hacktron chained multiple vulnerabilities to achieve remote code execution and gain access to OpenAI employee accounts and internal systems, according to a blog post detailing their findings.

“On July 25, 2026, we chained two critical vulnerabilities to compromise multiple OpenAI employees’ ChatGPT accounts,” Hacktron researchers Harsh Jaiswal, Mohan Pedhapati and Rahul Maini wrote. “With these accounts, we could then access internal OpenAI repositories, and potentially many other connectors.”

They said the attack began with a flaw in an image processing library that enabled remote code execution. That initial access was then used to extract authentication tokens, which allowed movement across connected systems, according to the blog.

The researchers demonstrated the access by performing a benign action using an employee account and did not exfiltrate sensitive data. The work was conducted under a coordinated disclosure program, and the vulnerabilities were fixed after reporting.

Hacktron used OpenAI rival Anthropic’s Claude AI to help with the operation. According to the researchers, the model was used iteratively to refine the attack path and improve the exploit chain, including in reconnaissance, vulnerability analysis and exploit development.

Vibhum Dubey, a cybersecurity researcher and red teamer, said the findings reflect a shift in how AI systems are being used in attack scenarios.

“The focus is moving from an AI’s vulnerability to being deceived to the degree to which the AI is allowed to act on this deception,” Dubey said. “An autonomous agent can interpret instruction, call tools, write or run code, access files, and communicate with other systems — creating a much wider attack surface than would be the case for a conventional chatbot.”

He added that even minor weaknesses can have wider consequences.

“One minor vulnerability in such an agent can have disproportionately negative consequences due to the agent’s potential to act autonomously, take initiative to achieve its goals, and operate across multiple systems,” Dubey said.

Codex sandbox escape

Researchers at another company, Accomplish, reported they were able to bypass sandbox controls in OpenAI’s Codex coding agent environment.

The researchers said the agent executed actions outside its intended scope and interacted with external systems despite restrictions designed to limit its behavior.

“We found two ways out of the OpenAI Codex sandbox and reported both to OpenAI on August 12, 2026. Both were fixed inside of eight days,” Accomplish principal security researcher Oren Yomtov wrote in a blog post.

According to the blog, the escape was achieved through interactions between the agent, its instructions and available tools, allowing it to operate beyond intended boundaries.

Dubey said enterprises should not rely on sandboxing as a standalone control.

“I would avoid thinking of a sandbox as an impenetrable security barrier,” he said. “If an enterprise can read or write data or execute code from an AI agent, they should think of additional controls needed to secure the larger system if a sandbox is compromised.”

Identity and access extend reach

Both disclosures highlight how identity systems influenced the scope of the demonstrations.

In the Hacktron case, the researchers said access to authentication tokens enabled movement across multiple systems after initial access was obtained. This allowed access to services beyond the initial entry point, according to the blog.

Dubey said enterprises should treat AI agents as privileged entities in such environments.

“Each AI agent should have its own identity with narrowly tailored permissions, limited, easily rotated credentials, tightly controlled network access and comprehensive logging,” he said.

Such architectures are widely used in enterprise environments, where authentication tokens and integrated services manage access across applications.

Dubey said the research should not be viewed as specific to a single vendor.

“I would not interpret the findings as a problem exclusive to one particular vendor of AI,” he said. “The findings help identify a much broader capability gap in enterprise security posture around AI.”

He added that conventional approaches may not be sufficient.

“Many enterprises are looking at conventional app security approaches as a way to secure AI, but these are fundamentally different systems that require new controls to properly secure their use, data, model, and compute assets,” Dubey said.

Dubey said organizations should design systems with the assumption that failures will occur.

“The true test of enterprise AI security will not be around preventing all AI failures but rather ensuring that a single compromised or manipulated agent cannot lead to a wider breach of an enterprise IT infrastructure,” he said.