Hacktron researchers gained access to OpenAI’s internal repositories. They were able to do this by exploiting a flaw in the company’s SSO, which allowed them to take over ChatGPT and Codex accounts. OpenAI paid the researchers $6,500 as a thank-you for discovering and reporting the vulnerability.
OpenAI’s community forum uses Discourse and a “Sign in with OpenAI” option via auth.openai.com. Researchers Harsh Jaiswal, Mohan Pedhapati, and Rahul Maini suspected that exploiting this could lead to a broader compromise of OpenAI. That turned out to be correct.
A dependency on Discourse was the culprit. Uploaded images with the HEIC and HEIF extensions were passed to ImageMagick instead of FastImage. The former uses libheif, a library with a heap buffer overflow vulnerability in the version used by Discourse (1.19.7) within a Docker image based on Debian 12. A notable detail is that Debian 13 still had the vulnerability but received an upstream fix that was not assigned a CVE number. In other words, the flaw was not officially a tracked vulnerability.
From forum to internal monorepo
Thanks to the overflow, the researchers were able to execute code on community.openai.com. Because OpenAI’s SSO implementation accepted both direct logins and logins via external services without further checks, attackers were able to take over any OpenAI forum visitor’s account thanks to the Discourse vulnerability. One of the accounts Hacktron discovered used GitHub SSO, which led to OpenAI’s internal monorepo. Just to prove that this infiltration was possible, the researchers merely opened a pull request without searching for third-party data or OpenAI’s IP.
The researchers emphasize that the privilege escalation issue was not due to Discourse, but to OpenAI’s SSO configuration. Any first- or third-party service behind this SSO could have enabled the infiltration.
Exploit built with Claude
OpenAI’s main rival turned out to be helpful in this regard. Anthropic’s Claude Opus 4.8 was not quite capable enough to build an exploit. Opus 5, which is partially exempt from the highly restrictive security measures surrounding the larger Fable 5, was able to do so within a few hours. Anthropic itself states that Opus 5 excels at finding vulnerabilities but is less effective at exploit development. In this situation, however, that did not prove to be an obstacle.
OpenAI had a fix ready within 14 hours. Discourse also published advisory GHSA-vhm9-85gw-x335 and added sandboxing for image processing.
Read also: Has OpenAI learned anything from the Hugging Face hack?