Hacktron AI says it managed to hack OpenAI in less than 72 hours. The security research team revealed that it chained two separate vulnerabilities to gain access to ChatGPT and Codex accounts belonging to OpenAI employees. To prove the access was real, the researchers used an employeeโs Codex account to open a harmless pull request in OpenAIโs internal monorepo rather than accessing sensitive code. The entire attack started with something that sounds relatively harmless: uploading an image.
Hacktron shared the details in a technical write-up on September 13, while also summarizing the exploit chain on X.
According to the researchers, the chain looked like this:
- HEIF upload โ libheif heap overflow โ remote code execution โ OpenAI SSO flaw โ ChatGPT/Codex takeover โ connected GitHub โ internal repository
Key Takeaways
- Hacktron AI says it compromised OpenAI systems in less than 72 hours.
- The attack began with a HEIF image upload and a vulnerability in libheif.
- An OpenAI SSO flaw allegedly allowed the researchers to move from the compromised forum to employee ChatGPT and Codex accounts.
- A connected GitHub integration provided a path to demonstrate access to OpenAIโs internal repository.
- OpenAI says it fixed its side of the issue about 14 hours after the report and later paid Hacktron a $6,500 bounty.
- The research highlights how AI can accelerate vulnerability research and exploit development, although Hacktron says human guidance was still necessary.
The Hack Started With a Heif Image
Hacktron was looking at the image-upload system used by OpenAIโs community forum, which runs on Discourse. The researchers noticed that HEIC and HEIF images were processed differently from other image formats. Because Discourseโs usual image-checking tool did not support HEIF, those files were passed to ImageMagick for conversion.
That meant the uploaded files eventually reached libheif, an image-processing library responsible for handling the format. Hacktron then discovered a heap buffer overflow in the version of libheif used by the environment.
According to the team, some security fixes had not been backported to the Debian package. This left the library vulnerable to a memory corruption attack that could provide out-of-bounds read and write capabilities. In other words, a specially crafted image could become much more than just an image.
AI Helped Turn the Bug Into an Exploit
This is where the story gets particularly interesting. Hacktron says it used AI models to help investigate and exploit the vulnerability.
The researchers initially worked with Claude Opus 4.8, asking it to examine the installed libheif package for potential security problems. The model helped identify the relevant vulnerability, but getting a reliable exploit working proved difficult when ASLR was enabled.
Then Anthropic released Claude Opus 5. Hacktron says the new model was able to produce a working ARM64 exploit within about three hours. The researchers then had it adapt the exploit to the x86-64 environment and the jemalloc configuration used by Discourse.
By the morning of July 25, the team says it had confirmed remote code execution through an image upload. And that was only the beginning.
The Openai SSO Flaw Changed Everything
Getting code execution on the forum wasnโt enough to reach OpenAI employee accounts. Hacktron discovered that the forum supported โSign in with OpenAIโ through OpenAIโs authentication infrastructure at auth.openai.com. The researchers believed this SSO setup could provide a route from a compromised forum account into other OpenAI services.
According to Hacktron, they were able to confirm that assumption. The researchers said they took over an OpenAI employeeโs ChatGPT and Codex accounts. That employeeโs Codex account was connected to OpenAIโs GitHub organization.
Rather than digging through OpenAIโs internal source code, Hacktron used the compromised Codex account to create a pull request in OpenAIโs internal monorepo. The team described the pull request as a harmless proof of concept and stopped testing after demonstrating the access.
OpenAI Fixed the Issue Within Hours
Hacktron reported its findings to OpenAI through the Bugcrowd bug bounty program on July 25. According to the teamโs timeline, OpenAI confirmed that its side of the issue had been fixed at around 22:49 UTC, roughly 14 hours after the initial report.
The researchers also reported the underlying Discourse vulnerability to Discourse through HackerOne. Discourse responded the next day and had a fix ready by July 27. The company also added sandboxing for ImageMagick as an additional security measure.
OpenAI later awarded Hacktron a $6,500 bounty for the OpenAI-side vulnerability. OpenAI clarified that testing against the Discourse-hosted community forum was outside the scope of its bug bounty program.
The Bigger Concern Is AI-Assisted Hacking
For Hacktron, this wasnโt just another vulnerability disclosure. The researchers say the experiment shows how AI is changing the amount of time and expertise required to turn vulnerabilities into working exploits.
Hacktron said the OpenAI and Discourse attack took a few days for an AI agent and only a few hours of human effort. Its broader HEIF Heist research reportedly involved three researchers and cost less than $3,000 in AI tokens.
The team is careful to point out that the process wasnโt completely autonomous. Human researchers still provided guidance and made important decisions during the operation. Still, the speed is notable. Hacktron argues that tasks that once required highly specialized security expertise and significant amounts of time can increasingly be accelerated by AI.
The incident also shows why vulnerabilities in seemingly ordinary software can have much wider consequences when that software is connected to authentication systems and other services.
