Hacktron AI researchers breached OpenAI's systems using AI models, exploiting vulnerabilities in its forum and single sign-on, leading to a significant security incident.
Researchers from Hacktron AI have successfully infiltrated OpenAI's internal systems by exploiting vulnerabilities in its forum and single sign-on mechanism. This breach, which took place on July 25, was executed in under 72 hours, starting with a hijacked employee account.
The attack leveraged two key vulnerabilities: the first allowed for remote code execution via image uploads on the community.openai.com forum, and the second involved the single sign-on system that linked the forum to OpenAI's ChatGPT and Codex services.
Exploiting Vulnerabilities with AI
The Hacktron team began their investigation by analyzing how the OpenAI forum processed HEIC and HEIF images. They discovered that the forum’s use of the libheif library through ImageMagick was missing critical security patches. By crafting a specific file, they could trigger a memory error that enabled code execution on the server.
Using the Claude Opus 4.8 model, they developed an attack vector but faced challenges with its reliability in the forum's standard setup. However, after the release of Claude Opus 5, they quickly adapted their approach, and within hours, they achieved successful remote code execution.
Subsequently, they exploited the second vulnerability to intercept accounts linked to OpenAI’s single sign-on system, notably accessing an employee's account that was tied to OpenAI's GitHub organization. To demonstrate the potential risk, they prompted Codex to create a harmless pull request in the internal repository before halting further testing.
Response and Impact
Hacktron pointed out that while the forum was the entry point, the vulnerabilities were rooted in OpenAI’s single sign-on framework, indicating that any linked service could have been exploited similarly. OpenAI responded to the breach about 14 hours after being notified, while Discourse implemented a fix by July 27 to enhance image processing security.
In recognition of their findings, OpenAI rewarded Hacktron with $6,500 on September 1, clarifying that the reward was for the vulnerabilities identified within OpenAI's infrastructure, not for the forum breach.
Cost and Efficiency of the Operation
Hacktron estimated that the AI-assisted operation cost under $3,000 over two months, highlighting a significant reduction in time and resources compared to traditional hacking methods. They noted that while AI played a crucial role, skilled oversight was still necessary for the process to be effective.
This incident follows previous reports where AI models from OpenAI and Anthropic inadvertently infiltrated external systems, raising concerns about the security implications of AI technologies in operational environments.
