Archive ◆BRAID DAILY
Claude helped researchers reach OpenAI's internal repos
Subscribe

◆ Braid Daily · 2026-09-18

Claude helped researchers reach OpenAI's internal repos

An OpenAI SSO misconfiguration and a libheif heap overflow exposed two distinct security paths.

Braid Daily issue artwork

The lead

1

The researchers trace two bugs: an SSO misconfiguration that exposed OpenAI accounts and internal repositories, and a heap overflow in libheif. The library is also used by Meta, Rails, Next.js, and ImageMagick, so the disclosure extends beyond one lab.

Read source
Two reported security paths: an SSO misconfiguration into OpenAI accounts and repositories, and a libheif heap overflow affecting several shared-dependency users.
The report joins an identity-path compromise at OpenAI with a separate shared-dependency risk in libheif.

Copyright and oversight

4

The underlying court filing

U.S. District Court, Southern District of New York

CourtListener hosts the September 17 filing in the consolidated OpenAI copyright litigation. It is the primary docket entry behind the latest reporting.

Read source

The evaluator bench is small and contested

Axios

Axios maps the dispute over who can credibly audit frontier systems, including scrutiny of METR's ties to the AI safety community. METR says it doesn't take funding from frontier labs, and that Paul Christiano joined OpenAI's nonprofit board after its investigation concluded.

Read source

The infrastructure squeeze

4

CXMT prepares to enter NAND flash

Reuters via Techmeme

Reuters reports that Chinese DRAM leader CXMT is preparing to expand into NAND flash amid memory shortages. The expansion would put it against Samsung, SK Hynix, and domestic rival YMTC in another part of the AI supply chain.

Read source

Solidigm considers a U.S. NAND factory

Reuters via Techmeme

SK Hynix subsidiary Solidigm is considering a U.S. NAND plant, while SK Hynix is reportedly discussing a separate Ohio project with Intel. Both talks address the same memory shortage with domestic capacity.

Read source

Agents and verification

3

Stripe moves fraud detection ahead of the transaction

AI News & Strategy Daily

Stripe saw a sharp increase in command-line interface usage without a product change and attributed it to agents discovering the interface. Its response shifts detection toward abusive customers before they spend stolen tokens or consume costly inference.

Read source

A cheap verifier catches most false passes

arXiv

A harness ablation matches fixed plans against shuffled policy text of equal length, separating useful guidance from prompt volume. Its read-only verifier rejects 61 percent of oracle-invalid retail episodes and withholds 17 percent of correct ones. The verifier costs less than one cent per episode.

Read source

Companion episode

Seventy-Two Hours and a Malformed Image

· 00:19:22