Hacktron chained an image-library bug in OpenAI's Discourse forum to a single sign-on misconfiguration, reached employee ChatGPT and Codex accounts inside 72 hours, and the repair OpenAI describes is a narrowing of token permissions.
Perspective Coverage
9 publishers
- Builder
- Builder 32%
- Operator
- Operator 37%
- Investor
- Investor 31%
Reality
- Evidence80
- Adoption45
- Hype gap+15
- Incentives68
- Confidence72
Hacktron AI chained a Discourse image-library flaw to a weakness in OpenAI's single sign-on and into the Codex environment in under 72 hours, after swapping Claude Opus 4.8 for Opus 5 to get a working exploit.
Perspective Coverage
4 publishers
- Builder
- Builder 30%
- Operator
- Operator 41%
- Investor
- Investor 29%
Reality
- Evidence60
- Adoption
- Not scored
- Hype gap+30
- Incentives65
- Confidence55
Google's threat intelligence group counts 18 exploited flaws a month in 2026, up from 10.5 in 2025, while zero-days rose only from eight to 11. GTIG attributes most of the added attacks to fast weaponization of disclosed n-days, so the exposure sits in the days after a patch ships.
Perspective Coverage
4 publishers
- Builder
- Builder 33%
- Operator
- Operator 61%
- Investor
- Investor 6%
Reality
- Evidence72
- Adoption
- Not scored
- Hype gap+30
- Incentives35
- Confidence65
Attackers exploited one in 431 new vulnerabilities this year by Google's count
Google's Threat Intelligence Group counted 141 flaws exploited in the wild from January to August, while monthly disclosures doubled to 10,740. Patch teams do better sorting by that exploited set than by the total, though attackers now reach some public flaws within days.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+15
- Incentives60
- Confidence50
The image parsing bug had been fixed upstream about a year earlier, and the decision not to ship that fix belonged to Discourse. OpenAI's forum shared single sign-on with internal systems, so a forum account became GitHub access.
Perspective Coverage
9 publishers
- Builder
- Builder 35%
- Operator
- Operator 39%
- Investor
- Investor 26%
Reality
- Evidence70
- Adoption63
- Hype gap+28
- Incentives60
- Confidence62
buildOne report1 publisher A prompt gateway would need to track multi-turn conversation context to catch Hacktron's OpenAI chain
An open-source gateway author walked Hacktron's five-step path into OpenAI through his own seven detection layers. The first two hops are requests to a forum and an identity provider. Where the gateway is deployed decides what any of it can read.
Reality
- Evidence35
- Adoption
- Not scored
- Hype gap+60
- Incentives80
- Confidence45