26.05.2025
2 min
770
Hacktron AI researchers discovered a chain of two vulnerabilities that allowed them to take control of OpenAI employees’ ChatGPT and Codex accounts. Through connected services, they could potentially have reached GitHub, Slack, email, and the company’s internal repositories.
Hacktron AI researchers discovered a chain of two vulnerabilities that allowed them to take control of OpenAI employees’ ChatGPT and Codex accounts. Through connected services, they could potentially have reached GitHub, Slack, email, and the company’s internal repositories.
The three-person research team, Harsha Jaiswal, Mohan Pedhapati, and Rahul Maini, went from the initial discovery to confirmed access to an internal OpenAI repository in less than 72 hours. Anthropic’s Claude model helped them with part of the exploit development. It all began with the community.openai.com forum, which runs on Discourse and allows users to sign in with an OpenAI account. The researchers suspected that compromising the forum could open a path to other company services through its single sign-on system.
The flaw was found in the way HEIC and HEIF images were processed. Discourse normally checks uploaded images using FastImage, but that component did not support HEIF, so such files were passed to ImageMagick for conversion. As a result, a specially crafted file was sent directly to the libheif library. In the libheif version used by Discourse’s Debian 12-based Docker image, the researchers found a heap buffer overflow. The vulnerability made it possible to read and modify memory, which was necessary to turn a specially crafted image into full remote code execution. At the time, Discourse was using the vulnerable libheif 1.19.7, while Debian 13 was also shipping the vulnerable 1.19.8 release.
On July 24, the team brought in Claude Opus 4.8 to help create a working exploit. The model was able to assist under simplified conditions, but attempts to make the attack reliable with address space layout randomization enabled did not produce the required result. Later that same day, Anthropic released Claude Opus 5, and the researchers repeated the experiment with the newer model. In about three hours, it produced a working ARM64 exploit on a local Mac, after which Claude was asked to adapt it for x86-64 and the jemalloc memory allocation configuration used by Discourse.
By the morning of July 25, the team had confirmed remote code execution through an image upload. The exploit was first tested in their own Discourse Cloud environment, and the researchers then managed to achieve remote code execution on OpenAI’s forum as well.
“When code execution took place inside a sandboxed or restricted environment, the models also helped with privilege escalation, lateral movement, and bypassing existing security mechanisms,” the Hacktron AI researchers said.
After the forum was compromised, a second issue emerged, this time directly related to OpenAI. The way the single sign-on system was configured made it possible to move from a compromised forum account to active ChatGPT and Codex accounts. The researchers emphasized that this part of the attack chain was not a Discourse-specific vulnerability. In one case, a compromised OpenAI employee account had Codex connected to the company’s GitHub organization. To demonstrate the real impact of the vulnerability without accessing internal code, the researchers instructed Codex to create a test pull request in OpenAI’s internal monorepository, after which they stopped further testing.
In theory, the consequences could have been much broader. If a user had connected other services to ChatGPT or Codex, the obtained access could have extended to GitHub, Slack, email, and other integrations. At the same time, the researchers stressed that they did not use the access to steal confidential information.
After confirming the issue, Hacktron AI reported it to OpenAI and Discourse. OpenAI fixed its part of the vulnerability roughly 14 hours after the initial report and later awarded the researchers a $6,500 bounty. The company clarified that the reward covered only the issue on OpenAI’s side, since testing community.openai.com was not formally included in its bug bounty program. Discourse also responded quickly: the company received the report on July 25, replied the following day, and had a fix ready by July 27. In addition to the patch itself, the developers introduced additional isolation for the image-processing process.
Hacktron AI’s broader research campaign, during which the team examined the use of libheif across various services, lasted about two months and cost less than $3,000 in AI model tokens. The attack chain targeting Discourse and OpenAI itself took several days of AI-agent work and only a few hours of direct human effort, while the researchers published a detailed breakdown of the entire attack in a Hacktron AI report.
The researchers stressed that this was not a fully autonomous attack. Experienced specialists still directed the process, but the use of modern AI models significantly increased the amount of work a small team could complete in a short period of time.
