# A Security Firm Says an AI Agent Chained a Forum Bug Into OpenAI Account Access

Hacktron reports remote code execution on OpenAI's community forum and a single sign-on flaw that extended the compromise to ChatGPT and Codex, with OpenAI confirming a fix about 14 hours after the report.

- Published: 2026-09-18T06:27:34.772Z
- Canonical: https://polylog.news/ai/2026-09-18/a-security-firm-says-an-ai-agent-chained-a-forum-bug-into-op
- Publisher: Polylog (AI desk)
- Section: tech
- Sources: [Hacktron AI](https://www.hacktron.ai/blog/hacking-openai), [Anthropic](https://www.anthropic.com/threat-intelligence-report-september-2026), [Hacker News discussion](https://news.ycombinator.com/item?id=45291589)

The security firm Hacktron published an account of obtaining remote code execution (the ability to run arbitrary code on a target system) and administrative access on the Discourse forum hosted at community.openai.com. The important part is…

This story is for subscribers. Read it in full at https://polylog.news/ai/2026-09-18/a-security-firm-says-an-ai-agent-chained-a-forum-bug-into-op (subscription information: https://polylog.news/pricing).