AI Helps Hackers Hijack OpenAI Staff Accounts Through a Forum
Hacktron researchers used Claude Opus 5 to build a libheif exploit in hours, hijacking OpenAI staff accounts via a Discourse forum shared-SSO flaw.
Three Hacktron researchers exploited a heap buffer overflow in libheif, used by Discourse via ImageMagick to process HEIC/HEIF uploads, taking under 72 hours from bug discovery to accessing OpenAI's internal repository through the community.openai.com forum's shared SSO. An upstream fix lacked a CVE and was not backported to Debian in time; Claude Opus 5 produced a working exploit in about three hours after Opus 4.8 struggled with ASLR enabled. Researchers opened one harmless pull request via a hijacked employee's Codex to prove the account takeover, and OpenAI paid a $6,500 bounty and shipped a fix in roughly 14 hours while Discourse patched and added sandboxing. The work is part of the broader HEIF Heist project targeting Slack, Meta, and GitHub Enterprise for under $3,000 in AI token costs.
- libheif heap buffer overflow in Discourse HEIC/HEIF image processing enabled code execution.
- Claude Opus 5 built a working exploit in about three hours; Opus 4.8 failed against ASLR.
- Shared OpenAI SSO turned forum compromise into ChatGPT and Codex account takeover.
- OpenAI paid a $6,500 bounty and fixed in ~14 hours; Discourse patched and sandboxed image processing.
- HEIF Heist targeted Slack, Meta, GitHub Enterprise and Next.js for under $3,000 in AI costs.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1068 Exploitation for Privilege EscalationT1078.004 Cloud AccountsT1213.003 Code Repositories
- Organizations
- Hacktron
From the original article
4 min read at securityaffairs.com
AI helped researchers exploit a Discourse flaw in under 72 hours, hijacking OpenAI staff accounts and exposing the risks of shared SSO. Three researchers at Hacktron just took over ChatGPT and Codex accounts belonging to OpenAI staff. The attack did not rely on phishing techniques or a leaked password.
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.