AI-Built Exploit and Sign-In Flaw Opened Path to Internal OpenAI Code
Researchers chained a libheif RCE in Discourse with an over-privileged OpenAI forum sign-in token flaw to take over ChatGPT and Codex accounts.
Hacktron researchers used Claude Opus 4.8 and Opus 5 to weaponize an unpatched libheif decoding flaw reached through Discourse's HEIC/HEIF handling on community.openai.com, achieving remote code execution. The upstream libheif fix landed a year earlier but was never treated as a security issue, so no CVE was assigned. Chained with OpenAI-side sign-in tokens carrying excessive permissions, the researchers took over an employee's Codex-linked account and opened a pull request in an internal OpenAI GitHub repository. OpenAI narrowed token permissions and revoked sessions roughly 14 hours after the Bugcrowd report, paying a $6,500 bounty, while Discourse patched within two days and added image-processing sandboxing.
- Claude-built exploit achieved remote code execution via a libheif flaw in Discourse image handling.
- Underlying libheif bug was fixed upstream a year earlier and never assigned a CVE.
- OpenAI forum sign-in tokens carried excessive permissions, granting full API access to ChatGPT and Codex.
- Researcher opened a pull request in an internal OpenAI GitHub repository to prove access.
- OpenAI paid a $6,500 bounty; Discourse patched within two days and added sandboxing.
- Vendors
- OpenAIDiscourseImageMagick
- Victims
- OpenAI
- AI models
- Claude Opus 4.8Claude Opus 5
From the original article
2 min read at securityweek.com
Hacktron researchers earned a bug bounty after demonstrating access to OpenAI employee accounts. The post AI-Built Exploit and Sign-In Flaw Opened Path to Internal OpenAI Code appeared first on SecurityWeek.
By Eduard Kovacs · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.