AI-built exploit and sign-in flaw exposed OpenAI code

Security firm Hacktron developed an exploit with the help of the Claude models Opus 4.8 and Opus 5, then combined it with a weakness in OpenAI’s forum sign-in system to access internal code repositories hosted through community.openai.com.

The entry point was OpenAI’s public community forum, which runs on Discourse. Discourse did not perform built-in checks for the HEIC/HEIF photo format, so uploads in that format were passed to ImageMagick for decoding. ImageMagick relies on the libheif library; Hacktron found a flaw in libheif that had been fixed upstream about a year earlier but had not been flagged as a security issue and therefore had no CVE.

Hacktron converted the decoding bug into a reliable remote code execution exploit after multiple attempts, first testing the exploit on a private Discourse instance and then using it on OpenAI’s forum.

The second element of the chain involved how the forum issued sign-in tokens. Because users can sign in to the forum with their OpenAI accounts, the tokens carried permissions that allowed full API access to linked ChatGPT and Codex accounts. Until the permissions were narrowed, any forum user or employee who logged in could have had those accounts taken over. Connected services, such as GitHub, Slack and email, could in theory have been reachable through account integrations.

To demonstrate the risk without removing or publishing sensitive code, Hacktron took control of an OpenAI employee account whose Codex integration was connected to OpenAI’s GitHub organization and used it to open a pull request in an internal repository, then stopped further testing. OpenAI’s review found limited reads of private-repository metadata and commits and noted that the researcher-submitted pull request modified only a README file. Hacktron did not verify access to employee Slack messages.

Hacktron reported the sign-in token issue to OpenAI through Bugcrowd. OpenAI narrowed the permissions on community sign-in tokens, revoked affected tokens and sessions, and applied a patch roughly 14 hours after disclosure. The company paid Hacktron a $6,500 bounty for the OpenAI-side finding. Hacktron reported the libheif flaw to Discourse through HackerOne; Discourse released a fix within two days, added image-processing sandboxing, and published a security advisory.

The technical chain combined HEIC/HEIF image handling, ImageMagick and libheif, and the forum’s integration with OpenAI authentication and API permissions. OpenAI wrote, “We thank the researchers for contacting us and sharing their findings.”