Hacktron AI Researchers Hack OpenAI via Forum Exploit, Earn $6,500 Bug Bounty

·10 views

On September 18, Ars Technica reported that researchers from Hacktron AI successfully compromised OpenAI systems using a multi-step attack chain. The breach began by exploiting a vulnerability in OpenAI's third-party Discourse forum, then escalated through internal sign-on systems to access an employee's ChatGPT account. Attackers ultimately exfiltrated sensitive code from GitHub and proposed unauthorized code changes before disclosing the findings. OpenAI acknowledged the researchers' report and awarded a $6,500 bug bounty for the discovery. The incident highlights how sequential, low-profile access steps can evade conventional single-request security scanners that do not analyze attack chains across multiple interactions.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Zero-Copy Method Cuts Memory Use in Python Video Streaming with OpenCV

A new pipeline paradigm aims to improve memory efficiency in real-time video streaming using OpenCV-Python, which typically creates and destroys numerous NumPy arrays during camera capture. The approach allocates a single memory buffer — a NumPy array — once at startup, then lets a high-performance C++ backend continuously update it with new frames instead of recreating it each time. OpenCV (C++), FFmpeg, and similar libraries can serve as the backend, with the C++ layer exposed to Python via pybind11. Python developers interact with a standard NumPy array that can be set as read-only, limiting unnecessary copies unless explicitly requested. The architecture reduces memory overhead while keeping the Python-facing API simple and familiar.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Guessing ATS job board slugs misfires half the time, study of 2,127 firms finds

A developer building a company-to-job-board index across 2,127 firms found that guessing URL slugs from company names works only about 26% of the time, and nearly half of those matches point to the wrong employer. Because Ashby and Lever do not include a company name in their API responses, there is no direct way to confirm board ownership from the payload alone. Greenhouse is the exception, returning a company name field that enables straightforward verification. A common but flawed workaround — comparing the company name against the job URL — simply checks whether the guessed slug matches itself, making it incapable of catching errors. The only reliable cross-platform method is cross-referencing known job titles from an independent source against the titles returned by the board.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Build a React Native Starter in 2026 That Actually Ships

A well-structured React Native boilerplate should prioritize time-to-first-paid-user over the number of included screens or libraries, according to a developer guide published on DEV Community. Essential components include end-to-end authentication with session restore, a fully working payments flow via Stripe or RevenueCat, and a configured EAS Build pipeline with staging and production profiles. Error boundaries paired with crash-logging tools like Sentry, along with OTA update channels via expo-updates, are also flagged as non-negotiable defaults. On the other hand, redundant animation libraries, custom UI kits, Redux boilerplate, and demo screens should be cut to reduce maintenance overhead. The recommended stack centers on Expo SDK 53+, expo-router, Zustand, TanStack Query, and Supabase, with the guiding principle that a good scaffold should make it trivial to delete what you do not need.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Builds AI-Human Cryptid Reporting System Using Sanity CMS

A developer has built an open-source 'Cryptid Field Station' as part of the Sanity Challenge, allowing hikers to submit reported cryptid sightings with location coordinates and photo or video evidence. On submission, an automated agent runs parallel checks — an AI credibility assessment via Google Gemini and a live weather data pull from Open-Meteo for the reported location and time. Depending on the agent's verdict, reports are either auto-approved, auto-rejected, or flagged for review by a human ranger who can verify, reject, or publish sightings through a real-time triage dashboard. Every status transition appends a verification document to the sighting, creating a shared audit trail authored by both the AI agent and the human reviewer. The project includes a built-in control test — a jackalope report that admits to being taxidermy — which is designed to always be rejected, serving as a live integrity check for the pipeline.

0 comments Read more at DEV Community