Security experts from Hacktron have successfully utilized AI tools to craft an exploit targeting vulnerabilities within OpenAI’s infrastructure. This exploit combined a weakness in an image-processing library with a flaw in OpenAI’s login system, leading to unauthorized access to internal code repositories.
Exploiting Image Processing Vulnerabilities
The breach initiated with OpenAI’s community forum, hosted on community.openai.com, which operates on the Discourse platform. A critical oversight in Discourse’s image processing, particularly its handling of the HEIC/HEIF photo format, allowed the exploit to occur. This format was processed by ImageMagick, where an unaddressed defect in the libheif library existed. Despite being resolved upstream a year ago, the flaw was never recognized as a security threat, thus escaping inclusion in the standard patching cycle.
Hacktron employed AI tools Claude Opus 4.8 and Opus 5 to develop a functional exploit that enabled remote code execution. Initially tested on a mock Discourse setup, the exploit was later applied directly to OpenAI’s forum, illustrating the potential for wider access to user and employee accounts.
Compromised Access and Broader Implications
Once the forum vulnerability was exploited, the potential for unauthorized access expanded significantly. Hacktron pointed out that anyone logging in with an OpenAI account could have their ChatGPT and Codex accounts compromised. This risk was exacerbated by the possibility of linked services such as GitHub and Slack being affected, although Hacktron did not confirm actual breaches of these services.
OpenAI clarified that the image-processing bug was an issue with the third-party Discourse platform, while the broader access problem stemmed from an OpenAI-specific flaw. The latter involved overly permissive tokens generated for the community forum which inadvertently granted extensive API access to associated accounts.
Response and Mitigation
In response to these findings, Hacktron demonstrated their access by taking control of an OpenAI employee’s account, which was connected to a GitHub organization. They opened a pull request in a private repository to illustrate the extent of their access without delving into sensitive internal code.
OpenAI’s internal investigation reported limited access to private repository metadata and specific file modifications, with no further unauthorized actions taken. Hacktron reported the vulnerabilities through Bugcrowd and HackerOne, leading to a swift resolution by OpenAI and Discourse. OpenAI issued a statement thanking Hacktron for their responsible disclosure and took measures to narrow permissions on sign-in tokens, revoking those already issued.
As a token of appreciation, OpenAI awarded Hacktron a $6,500 bounty for uncovering the vulnerability. These events underscore the importance of collaboration between tech companies and security researchers in strengthening digital defenses.
