OpenAI faces internal security concerns over code access

Staff spent years warning that OpenAI's shared code repository exposed too much, and a researcher breach showed how fast an outsider could get in OpenAI keeps much of its code in one enormous shared repository. For years, employees warned that this setup let anyone with code access peek at projects far outside their own job. Those warnings did not lead to a fix in time. In 2026, outside security researchers showed the same repository could be reached from a weak point on the company’s community forum, and they did it in under 72 hours. One keycard, every floor At OpenAI, that meant staff with code access could view details of many projects unrelated to their roles. Current and former employees repeatedly flagged this as a risk, arguing that loose internal controls could expose sensitive work to people who had no business seeing it. The complaints are not new. Employees raised security concerns with leadership before ChatGPT launched in November 2022. According to those staff accounts, management seemed more focused on shipping quickly than on locking things down. How Hacktron got inside The warnings became concrete when researchers from security firm Hacktron went looking for holes...