A security incident involving OpenAI, Anthropic’s Claude, Codex and GitHub illustrates a problem enterprises will increasingly encounter as AI agents inherit access from human identities.
Security researchers at Hacktron used Claude Opus 5 while investigating vulnerabilities associated with OpenAI’s community forum. According to the researchers’ disclosure and subsequent reporting, the exploit chain ultimately allowed them to take over OpenAI employee ChatGPT and Codex accounts. One compromised employee’s Codex environment was connected to OpenAI’s GitHub organization. To demonstrate the impact without examining proprietary source code, the researchers instructed the compromised Codex account to open a harmless pull request in OpenAI’s internal monorepo.
The researchers were conducting authorized security research and responsibly disclosed the vulnerabilities. The importance of the episode for enterprise AI is therefore not that an AI agent “went rogue.” It is the authority chain that the incident exposes.
A compromised human identity can carry valid authentication. An AI service can correctly recognize that identity. A connected coding agent can possess legitimate technical permissions. GitHub can correctly accept a request made with those credentials. Every authentication and permission check in the downstream chain can appear valid while the enterprise authority behind the action is wrong.
Authentication can be completely correct while authority is completely wrong.
That distinction becomes more important as enterprises connect AI agents to source control, cloud platforms, email, databases, internal APIs and production infrastructure. Identity systems answer who or what is presenting credentials. Permission systems determine what those credentials are technically allowed to access. Those controls are essential, but an autonomous system introduces another question: did the enterprise actually authorize this principal, acting through this agent, to pursue this objective and produce this particular effect?
Possession of a valid credential cannot be allowed to answer that question by itself.
Consider the GitHub example. A developer may legitimately have permission to open pull requests across an organization. A coding agent acting for that developer may legitimately inherit some of that access. But a valid session should not automatically become a blanket enterprise mandate. The authority to open a particular pull request should be traceable to an objective, a principal, an agent, a repository, a scope, a time period, applicable constraints and a delegation chain.
This is where enterprise authority needs to become independent of the acting agent and independent of authentication alone.
Authrizd is being designed around that separation. Before a consequential AI action executes, the authority layer can determine whether the proposed effect is inside a valid enterprise mandate. The resulting evidence should establish who authorized the objective, what was delegated, which agent acted, what constraints applied, what action was proposed and why the action was allowed or denied.
The same principle extends well beyond GitHub. A compromised account could invoke an agent connected to Slack, email, cloud infrastructure, a database, an ERP system or physical equipment. As agents gain more integrations, a compromised principal can become a force multiplier unless authority is independently constrained.
This does not replace authentication, IAM, GitHub permissions or platform security. Those systems answer different and necessary questions. Enterprise authority adds another control boundary above them.
The emerging rule is straightforward: a credential can establish identity and access, but it cannot manufacture a mandate.
As AI becomes capable of acting across increasingly consequential systems, enterprises will need to prove not merely that the actor was authenticated, but that the action itself was authorized.
Sources
NEXT STEP