Hacktron chained two vulnerabilities and got into OpenAI accounts in 72 hours

Researchers from Hacktron — Harsh Jaiswal, Mohan Pedhapati and Rahul Maini — published a report on 13 September describing how they chained two vulnerabilities and gained access to OpenAI employees' ChatGPT and Codex accounts, and through connected services to the company's internal repositories as well. The whole thing took less than 72 hours, from the first finding to logging into someone else's account.

The first link was a flaw in the libheif library. OpenAI's community forum runs on Discourse, and uploaded images in HEIC/HEIF format were sent off to ImageMagick for conversion, which opened the file directly with the libheif parser. In the Debian 12-based Discourse image, some security patches had not been carried over, so a specially crafted image achieved code execution on the server.

The second link was a flaw in OpenAI's single sign-on. It was what turned the forum compromise into a takeover of ChatGPT and Codex accounts. The authors stress that the weak spot is not in Discourse but in how third-party services are tied to OpenAI SSO — any application with such a login was at risk, and there are many connections: repositories, messengers, mail.

To prove access without reading a single line of internal code, the researchers opened a pull request in the company's internal monorepo in an employee's name. Testing was then halted and the report sent to the Bugcrowd program. OpenAI confirmed the fix roughly 14 hours later and paid the researchers $6,500.

A noticeable part of the work was done by Anthropic models. Opus 4.8 found the unpatched hole and built a working exploit, but could not manage with memory protection enabled. Opus 5 came out that evening — and within a few hours there was a working version for the required architecture. To apply it against the real target, though, the agent had to be walked through a CTF-like range: it refused to write an exploit for a remote system.

Disclosure moved fast: Discourse received the report on Saturday via HackerOne, replied on Sunday, had a fix ready by Monday and additionally isolated image processing in a sandbox, and on 28 July issued a public advisory. The whole story took a few hours of human time.

The takeaway for anyone running their own infrastructure: if you deploy Discourse, the installation has to be rebuilt, not just updated through the web interface — old images carry the vulnerable version of libheif. Applications that accept user-supplied HEIC/HEIF images should update libheif and libde265, and image parsing is best kept in an isolated environment.

Image: Michael Townsen Hicks, James Humphries, Joe Slater CC BY 4.0 · License

Translation editors: Соловьев В., Пеков А.