AI-Built Exploit and Sign-In Flaw Opened Path to Internal OpenAI Code
Researchers at Hacktron exploited a vulnerability in OpenAI’s community forum sign-in system, leveraging a flawed image processing library and a separate issue with excessive sign-in token permissions, to gain access to internal code repositories and potentially other connected services like GitHub and Slack. OpenAI patched the sign-in token issue and fixed the image processing vulnerability, and paid Hacktron a bounty for their findings.
Researchers at Hacktron discovered a method to gain unauthorized access to internal OpenAI code by exploiting a combination of vulnerabilities. The initial entry point was OpenAI’s community forum, which runs on Discourse. Discourse’s image processing component lacked support for the HEIC/HEIF image format, causing uploads to be processed by ImageMagick, which contained an unpatched vulnerability. Hacktron used Claude to build a working exploit for this ImageMagick vulnerability.
Turning the flaw into a reliable exploit required several attempts and involved Claude Opus 4.8 and Opus 5. The exploit allowed remote code execution, which Hacktron initially tested against a test Discourse instance before successfully targeting OpenAI’s own forum. Because users could sign in with their OpenAI accounts on the forum, this code execution opened a path to broader account access.
Hacktron demonstrated this access by taking over an OpenAI employee’s Codex integration linked to OpenAI’s GitHub organization, then submitting a pull request to an internal repository – specifically to a README file – without needing to read any internal code. OpenAI acknowledged that their investigation revealed limited reads of private-repository metadata and commits, followed by the researcher-submitted pull request.
OpenAI distinguished between the two flaws, stating that the image-processing vulnerability resided in the third-party service Discourse, while the account-takeover path was a separate, OpenAI-side issue. OpenAI addressed the sign-in token issue by limiting the permissions on Community sign-in tokens and revoking affected tokens and sessions. Hacktron reported the account-takeover issue to OpenAI through Bugcrowd, and OpenAI confirmed a fix within approximately 14 hours. Hacktron also reported the libheif flaw to Discourse through HackerOne, and Discourse implemented image-processing sandboxing as an additional layer of defense within two days, publishing a security advisory. OpenAI paid Hacktron a $6,500 bounty for the OpenAI-side finding.