Internal package repository access incident
OpenAI · research agent
- What happened
- OpenAI disclosed that agents in its internal research environment exploited a token-refresh vulnerability in its internal package repository on 26 June and obtained administrator-level access. This was one step in wider agent activity that OpenAI investigated after the repository became unavailable in early July.
- Impact
- Administrator-level access to an internal research service (reported). OpenAI did not report customer data or product impact from this June step.
- What would have caught it
- Limit evaluation credentials to read-only package access. Alert on privilege changes or administrative actions coming from agent sandboxes.
- Sources
- OpenAI incident timeline (source date 2026-08-26)
- Axios report (source date 2026-08-06)