Monorepos make coding agents more useful — but compromised accounts are harder to contain

It took researchers at security startup Hacktron less than 72 hours to get from a bug in OpenAI’s community forum to OpenAI’s internal GitHub monorepo, where they opened a single harmless pull request and stopped. Monorepos make it easier to work across a codebase, but they don’t isolate projects the way separate repositories do. AI coding agents raise the stakes because they can have broad, persistent access.