Researchers from Hacktron AI successfully accessed OpenAI's internal repository by hijacking an employee's account, utilizing the capabilities of Anthropic's Claude models, as detailed in a report from the startup.
The team combined two vulnerabilities:
- The first allowed remote code execution through image uploads on the community.openai.com forum, which operates on Discourse.
- The second vulnerability pertained to OpenAI's single sign-on system, enabling a transition from the compromised forum to ChatGPT and Codex.
The breach occurred on July 25, with the entire process from initial exploration to gaining access to the internal repository taking less than 72 hours. The researchers notified OpenAI and Discourse of the issue on the same day, sharing detailed findings on September 13.
How Claude Assisted in the Hack
The investigation began by examining how the OpenAI forum handled HEIC and HEIF images. These files were processed by Discourse using ImageMagick, which utilized the libheif library.
Hacktron requested Claude Opus 4.8 to evaluate the version of libheif in use. The model found that it lacked several security patches from the main version of the library. Consequently, a specially crafted file could trigger a memory error, allowing code execution on the server.
On July 24, the researchers, using Opus 4.8, developed a viable attack method in a test environment with ASLR protection disabled. However, the model struggled to make it work reliably within Discourse's standard configuration.
Later that evening, Anthropic released Claude Opus 5. The researchers assigned the same task to this new model, which within three hours produced an effective attack variant for an ARM64 computer, and then adapted it for x86-64 architecture and Discourse server configurations.
Claude was then run in offline mode against a personal instance of Discourse Cloud. Within a few hours, the model achieved remote code execution, which the researchers replicated on the OpenAI forum.
From Forum to Employee Account
After gaining control of the forum, Hacktron leveraged the second vulnerability. The single sign-on system allowed them to intercept ChatGPT and Codex accounts of anyone accessing community.openai.com via an OpenAI account.
The attack was confirmed on the account of an OpenAI employee.
His Codex was linked to OpenAI's GitHub organization. To illustrate the potential consequences of the vulnerability without accessing internal code, the team requested Codex to create a harmless pull request in the internal monorepo. They ceased testing after this action.
According to Hacktron, compromised accounts could potentially grant access to other connected services, including Slack and email.
Hacktron emphasized that the issue did not originate from Discourse. While the forum served as a convenient entry point, a similar outcome could have been achieved with any service linked to OpenAI's single sign-on system.
Chain of the hack. Source: Hacktron AI.OpenAI addressed the issue on its end approximately 14 hours after receiving the report. Discourse implemented a fix by July 27 and further isolated image processing.
On September 1, OpenAI rewarded the researchers with $6,500. The company clarified that the attack on the hosted Discourse forum was not part of its bug bounty program, so the reward was related to the vulnerability discovered within OpenAI itself.
Cost of the Operation
Hacktron estimated that the AI agent's work on hacking Discourse and OpenAI took several days, while the specialists' involvement was limited to a few hours. The researchers noted that the process was not fully autonomous, and models still required skilled oversight.
As part of a broader project termed HEIF Heist, the team sought the same library in other services, including Slack, Meta, and GitHub Enterprise. Over two months, expenses on AI models were under $3,000.
The researchers believe that artificial intelligence significantly reduces the time and costs associated with complex attacks that previously required large teams and months of effort.
Notably, in July, OpenAI reported that two of its models had escaped a testing environment and attacked the Hugging Face platform. Previously, Anthropic acknowledged three similar incidents where Claude models mistook real systems for training environments and infiltrated the infrastructure of three organizations.