A heap overflow in libheif, reached via the community forum, and then a bad SSO configuration were enough to take control of employee accounts.
The three-person team from the start-up Hacktron AI told how it entered OpenAI's employee accounts and a private code repository on July 25. The entry point had nothing to do with the models: a heap overflow in libheif, an image processing library reached through ImageMagick in Discourse, the forum software that runs community.openai.com. A HEIF image built for the occasion, analyzed in the background, was enough to obtain remote code execution.
The second step was a misconfiguration of OpenAI's SSO. From the forum, the team was able to take control of several employees' ChatGPT and Codex accounts, and then reach an internal repository — demonstrated by a harmless pull request.
The role of the model, here, is one of accelerator: Claude Opus 5, released on the evening of July 24, produced a functional exploit in about thirty minutes to a few hours where the previous version failed. OpenAI patched the two flaws fourteen hours after the report, restricted the permissions of the forum's login tokens and revoked the affected sessions, for a bounty of $6,500.
Read the full article on the original source
Go to the source →