Three researchers from Hacktron, a security firm, leveraged Anthropic’s Claude Opus 5 to exploit vulnerabilities and gain access to OpenAI staff accounts, including ChatGPT and Codex accounts. This breach also extended to an internal code repository at OpenAI.
Details of the Security Breach
The researchers identified a chain of two flaws, beginning with a bug in OpenAI’s public help forum and extending to a weakness in OpenAI’s login system. Although this was a controlled security test and not an actual cyberattack, the researchers demonstrated their access by making a benign pull request, ultimately securing a $6,500 bounty from OpenAI.
The issue was resolved by OpenAI approximately 14 hours after it was reported. However, OpenAI has not publicly detailed the login flaw, opting instead to acknowledge the issue through the fix and bounty payout.
Technical Insights and Vulnerabilities
The incident revealed significant vulnerabilities in OpenAI’s single sign-on (SSO) system. By exploiting a bug in the forum, researchers could control the ChatGPT and Codex accounts of OpenAI employees. The flaw originated in the image processing software used by OpenAI’s forum, which allowed an image to corrupt the server memory.
This memory corruption, rated as remote code execution, was possible due to a flaw in the libheif library, which was later patched. However, outdated versions were still in use on the forum’s server image, exposing the system to exploitation.
The Role of AI in the Exploit
AI played a crucial role in this exploit, with Claude Opus 5 assisting in developing the attack. Although initially, Claude Opus 4.8 struggled with the task, the newer Claude Opus 5 model succeeded quickly.
The researchers bypassed the AI model’s safeguards by configuring it for a controlled test environment, demonstrating how AI can expedite security research but still requires human oversight. This incident underscores the potential of AI in both offensive and defensive cybersecurity applications.
Implications and Recommendations
This incident highlights the broader security implications for organizations using single sign-on systems. Public services sharing SSO with internal tools can expose critical systems to breaches if not properly secured. Organizations are advised to update libheif to the latest security release and consider additional security measures, such as sandboxing image processing and tightening SSO permissions.
Despite the potential severity of the exploit, there is no evidence that it was used in real-world attacks. The incident serves as a reminder of the importance of proactive security measures and thorough vulnerability assessments.
