Researchers Chained AI-Built Exploit and Sign-In Flaw to Access OpenAI Repositories
Summary
Hacktron says it used Claude to build an exploit and chain it with an OpenAI sign-in flaw, gaining limited access to private-repository metadata and commits. OpenAI and Discourse fixed the issues; OpenAI revoked affected tokens and sessions.
Key points
- Hacktron used Claude to develop a working exploit for an unpatched libheif flaw exposed through image uploads to OpenAI’s Discourse forum.
- The researchers chained remote code execution with an OpenAI sign-in-token flaw that granted excessive permissions to associated ChatGPT and Codex accounts.
- Hacktron used an employee account linked to OpenAI’s GitHub organization to open a pull request, then stopped testing without reading internal code.
- OpenAI said its review found limited reads of private-repository metadata and commits, along with the researcher-submitted README pull request.
- Hacktron said connected services such as Slack might theoretically have been exposed; OpenAI said access to employee Slack messages was not verified.
- OpenAI narrowed Community sign-in token permissions and revoked affected tokens and sessions. Discourse fixed the libheif issue and added image-processing sandboxing.
- Hacktron reported the OpenAI issue through Bugcrowd and received a $6,500 bounty; it reported the libheif flaw to Discourse through HackerOne. Discourse published a security advisory.
Article Details
- Victim Organization
- OpenAI
- Victim Domain
- openai.com
- Incident Type
- Exploitation of an image-processing vulnerability and a separate sign-in token flaw enabled account takeover and access to internal repository metadata and commits.
- Data Types Exposed
- Private-repository metadata
- Private-repository commits
- Operational Impact
- OpenAI said its review found limited reads of private-repository metadata and commits, followed by a researcher-submitted pull request to a README file. Hacktron said it stopped testing after opening the pull request. Actual access to employee Slack messages was not verified.
- Claim Status
- confirmed
MITRE ATT&CK
Vendors
DiscourseThe entry point was OpenAI’s community forum, community.openai.com, which runs on Discourse.OpenAIa working exploit for a vulnerability in an image-processing library, then chained it with a flaw in OpenAI’s sign-in system to take over employee ChatGPT and Codex accounts, and ultimately gained access to
Products
ChatGPTimage-processing library, then chained it with a flaw in OpenAI’s sign-in system to take over employee ChatGPT and Codex accounts, and ultimately gained access to internal code repositories.Codexlibrary, then chained it with a flaw in OpenAI’s sign-in system to take over employee ChatGPT and Codex accounts, and ultimately gained access to internal code repositories.DiscourseThe entry point was OpenAI’s community forum, community.openai.com, which runs on Discourse.ImageMagickDiscourse’s built-in image checks didn’t support the HEIC/HEIF photo format, so uploads in that format were passed to ImageMagick, exposing an unpatched flaw in the libheif library it relies on for decoding.libheifDiscourse’s built-in image checks didn’t support the HEIC/HEIF photo format, so uploads in that format were passed to ImageMagick, exposing an unpatched flaw in the libheif library it relies on for decoding.