Risky Business #854 -- We're Jevpilled

…the thought process was, but they then decided, well, let's see if we can go a little bit further. And what they then determined was that the tokens they'd exfiltrated from the discourse forum didn't just work to authenticate users onto the forum, but the exact same tokens could be used to sign in to chat GPT. Not only that, but you could also access all of the OAuth grants and other services that you'd integrated with your chat GPT or codex accounts. So, you know, everyone connects their GitHub to their codex account, because that's how you do the coding. And so, you know, through an amazing, literally zero effort pivot,…

This does seem like really sloppy security on OpenAI's part (and they also sued the bounty hunters).