[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fNWt0OlXYStt_Zoq8Wgo7si4jqKflQjpABNAkZk1mVxA":3},{"article":4,"iocs":54},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":31,"category":32,"article_tags":36},"6b847759-9301-45a9-adf8-ce7093284b8e","AI-Built Exploit and Sign-In Flaw Opened Path to Internal OpenAI Code","ai-built-exploit-and-sign-in-flaw-opened-path-to-internal-openai-code-4fb2dc","Hacktron researchers earned a bug bounty after demonstrating access to OpenAI employee accounts. The post AI-Built Exploit and Sign-In Flaw Opened Path to Internal OpenAI Code appeared first on SecurityWeek.","Security researchers Hacktron leveraged AI, specifically Claude, to craft an exploit for a libheif vulnerability. This exploit was then chained with a sign-in flaw in OpenAI's community forum, leading to the compromise of employee ChatGPT and Codex accounts. The researchers gained access to internal code repositories, demonstrating the potential for significant data exposure.","Hackers used AI to exploit a libheif flaw and OpenAI sign-in vulnerability to access internal code.","Researchers at security firm Hacktron used Claude to build a working exploit for a vulnerability in an image-processing library, then chained it with a flaw in OpenAI’s sign-in system to take over employee ChatGPT and Codex accounts, and ultimately gained access to internal code repositories. The entry point was OpenAI’s community forum, community.openai.com, which runs on Discourse. Discourse’s built-in image checks didn’t support the HEIC\u002FHEIF photo format, so uploads in that format were passed to ImageMagick, exposing an unpatched flaw in the libheif library it relies on for decoding. Hacktron says the underlying bug had been fixed upstream a year earlier without ever being flagged as a security issue, so it was never assigned a CVE and missed the usual patching cycle. Turning the flaw into a reliable exploit took several attempts and involved Claude Opus 4.8 and Opus 5. The exploit allowed remote code execution, which the researchers first used against a test Discourse instance, then on OpenAI’s own forum. Because the forum let people sign in with their OpenAI account, code execution there opened a path to broader account access. Hacktron says that until the issue was fixed, any user or employee who logged into the forum could have had their ChatGPT and Codex accounts taken over. In addition, since people often connect other services to those accounts, the theoretical exposure extended to services like GitHub, Slack and email.Advertisement. Scroll to continue reading. OpenAI distinguishes between the two flaws. It told SecurityWeek that the image-processing bug lived in the third-party service Discourse, while the account-takeover path was a separate, OpenAI-side issue. The OpenAI weakness was related to sign-in tokens generated for the community forum carrying excessive permissions and granting full API access to associated ChatGPT and Codex accounts. To demonstrate the access without reading any internal code, Hacktron says it took over an OpenAI employee’s account whose Codex integration was linked to OpenAI’s GitHub organization, then used it to open a pull request in an internal repository before stopping further testing. OpenAI said its own review of the incident found limited reads of private-repository metadata and commits, followed by the researcher-submitted pull request, specifically to a README file. Hacktron’s report also raises Slack as a service that could theoretically have been reached through connected accounts. OpenAI says Hacktron did not verify actual access to employee Slack messages. The security firm reported the account-takeover issue to OpenAI through Bugcrowd, and the AI giant confirmed a fix about 14 hours later. It separately reported the libheif flaw to Discourse through HackerOne. Discourse had a fix ready within two days and added image-processing sandboxing as an extra layer of defense, then published a security advisory. In a statement, OpenAI said, “We thank the researchers for contacting us and sharing their findings. We narrowed the permissions on Community sign-in tokens and revoked affected tokens and sessions.” The company paid Hacktron a $6,500 bounty for the OpenAI-side finding. Related: OpenAI Says Its Models Searched GitHub for Leaked API Keys During Training Related: AI Agents Can Retrain Own Models Mid-Task, Leaking Secrets and Erasing Refusals Related: OpenAI Investigates Report Linking AI Agents to RubyGems Attack Written By Eduard Kovacs Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Eduard Kovacs OpenAI Says Its Models Searched GitHub for Leaked API Keys During TrainingCISA Retires Weekly Vulnerability Bulletin in Risk-Based PivotAI Agents Can Retrain Own Models Mid-Task, Leaking Secrets and Erasing RefusalsPixel Modem Zero-Day Exploited in Targeted AttacksUS, UK, Dutch Agencies Expose Iranian ‘Chosen Brick’ Surveillance MalwareEnterprises Warned of Attacks Exploiting WSO2 VulnerabilityTexas Utility CenterPoint Energy Confirms Breach After Hacker Leaks DataOpenAI Investigates Report Linking AI Agents to RubyGems Attack Latest News 23 Million User Records Compromised in Gyazo Data Breach Microsoft Patches 18 Vulnerabilities in AI, Cloud ProductsNightmareStresser DDoS Service Disrupted in International OperationBrevo Supply Chain Attack Injects Malware Into 100,000 WebsitesCritical Orkes Conductor Vulnerability Exploited in AttacksMIND Secures $72 Million for AI-Powered DLPCheck Point, Kaspersky, Tanium Patch Product VulnerabilitiesCyberattacks on Two Oil Tankers Prompt Coast Guard, FBI to Board Vessels Trending Daily Briefing NewsletterSubscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Virtual Event: Attack Surface Management Summit 2026 September 16, 2026 Join as speakers examine the various components of ASM strategy, the push to mandate continuous asset visibility and inventory tools, and the use of red-teaming, bug bounties and pen-tests in modern security programs. Register Webinar: Building Continuous Authorization at Scale September 23, 2026 Explore what it takes to operationalize continuous authorization at scale, including the technical, organizational, and cultural changes required. Register People on the MoveVeritas Capital has appointed Joel Fulton as Chief Information Security Officer.incident.io has appointed Carlos Gonzalez-Cadenas as Chief Operating Officer.Ruben D. Chacon has joined ADM as Vice President and Global CISO.More People On The MoveExpert Insights “We Think the Security Control Is Working” Is No Longer Good Enough Point-in-time audits and sampled assessments offer only snapshots; continuous control monitoring provides evidence that security controls are working today. (Sravish Sridhar) This Key Will Self-Destruct: An Open Standard for Revocable API Keys Every leaked credential should be dead, or dying, within sixty seconds of being found. Here's a proposal to make that the default. (Matt Honea) What the Hugging Face Incident Teaches Security Leaders About AI Agent Access Security teams must treat autonomous agents as highly privileged identities. (Etay Maor) The Future of AI-Driven Security Depends on Complete Data For twenty-five years, \"data\" in security meant logs and events. But logs are a lossy representation of reality. (Danelle Au) The MFA Identity Trap: When Authentication Creates a False Sense of Security Organizations must distinguish identity verification, authentication and threat detection, or risk successfully authenticating the attackers they are trying to stop. (Torsten George) Flipboard Reddit Whatsapp Whatsapp Email","https:\u002F\u002Fwww.securityweek.com\u002Fai-built-exploit-and-sign-in-flaw-opened-path-to-internal-openai-code\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2026\u002F06\u002FOpenAI.jpeg","2026-09-18T12:45:24+00:00","2026-09-18T14:00:09.302556+00:00",8,[18,21,23,25,27,29],{"name":19,"type":20},"Claude","product",{"name":22,"type":20},"ChatGPT",{"name":24,"type":20},"Codex",{"name":26,"type":20},"Discourse",{"name":28,"type":20},"ImageMagick",{"name":30,"type":20},"libheif","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":31,"icon":33,"name":34,"slug":35},null,"Breaches","breaches",[37,42,44,49],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":31,"icon":33,"name":34,"slug":35},{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[]]