Security startup Hacktron AI said it used Anthropic's Claude models to develop an exploit chain that compromised OpenAI employee ChatGPT and Codex accounts, and reached an internal OpenAI repository. The researchers reported the issue to OpenAI in July.
According to Hacktron, the chain combined a heap buffer overflow in the libheif image-decoding library with a single sign-on flaw in OpenAI's identity infrastructure. The researchers said they reached the vulnerability through OpenAI's Discourse-based community forum, where HEIF (High Efficiency Image FIle) images were processed using ImageMagick—an open-source software for editing digital images—and a vulnerable version of libheif, an open-source software library.
Hacktron said the forum access was then used to exploit an OpenAI SSO misconfiguration. The company said this gave the researchers access to ChatGPT and Codex accounts belonging to OpenAI employees, including an employee whose Codex was connected to OpenAI's GitHub organization.
To demonstrate the impact, Hacktron used the employee's Codex to open pull request #1186742 in OpenAI's internal openai/openai repository. The researchers said they stopped testing after demonstrating access and did not intentionally inspect proprietary source code.
Hacktron said a cybersecurity-research-access version of Claude Opus 4.8 initially struggled to produce a reliable exploit once address-space layout randomization, or ASLR, was enabled. After Anthropic released Claude Opus 5 on July 24, the researchers said the newer model produced a working ARM64 exploit within about three hours.
They then adapted the exploit to the x86-64 architecture and jemalloc, the memory allocator used in the Discourse environment, according to Hacktron. They said they confirmed remote code execution through an image upload before using the exploit against OpenAI's forum.
The full path from the initial discovery to access to OpenAI's internal repository took less than 72 hours, according to Hacktron. The company said its wider "HEIF Heist" research across multiple companies took two months and cost less than $3,000 in token spending.
Hacktron said OpenAI confirmed that its side of the issue had been fixed about 14 hours after the initial report and later awarded the company a $6,500 bounty. OpenAI clarified that testing against the Discourse-hosted forum itself was outside the scope of its bug bounty program, and that the award recognized only the OpenAI-side SSO finding, not the actions taken against Discourse. OpenAI also said it had narrowed permissions on Community sign-in tokens and revoked affected tokens and sessions.
Discourse separately addressed the image-processing vulnerability and added sandboxing for image processing, according to Hacktron's disclosure timeline.
Hacktron said the broader research shows how AI models can reduce the time and expertise needed to turn known memory-corruption vulnerabilities into working exploits. The researchers also stressed that human guidance remained important throughout their work.
Your reaction
Discussion
What's your take on this story?
No comments yet — be the first to share your view.