AI Helped Hijack OpenAI Employee Accounts Through a Chain of Vulnerabilities

Three specialists from Hacktron, a company that describes itself as an AI-assisted vulnerability research firm, demonstrated how a pairing of two flaws makes it possible to hijack the work accounts of OpenAI employees and gain access to an internal code repository. This was strictly research work: the team reported its findings, confirmed access with a harmless pull request, and stopped there. Less than 72 hours passed from the first look to internal access.

OpenAI closed the hole roughly 14 hours after the report and, on September 1, paid the researchers a $6,500 reward — noting that the bounty recognizes specifically the vulnerability on OpenAI's side, not actions against Discourse, the forum software, which was not covered by the bug bounty program.

How the Forum Opened the Door to Work Accounts

The starting point was a vulnerability in image processing. The forum runs on Discourse, which passes uploaded HEIC and HEIF files to ImageMagick, which in turn reads them through the libheif library. The flaw CVE-2026-32882 lets a specially crafted image corrupt the server's memory. In vulnerability databases it is listed as an out-of-bounds read — capable of crashing the process or disclosing neighboring memory, but not as direct code execution. The memory leak helped bypass ASLR protection, and, according to the researchers, a combination of libheif bugs yielded working code execution on the forum server.

The patch shipped in libheif 1.22.0 back in May 2026. But the forum server image, built on Debian 12, was still delivering the old version 1.19.7 in July: the fix and the CVE were public, yet they had not yet made it into the distribution's package.

Next, it was not the forum software that came into play, but the login system. The forum offered sign-in via "Sign in with OpenAI" — the same single sign-on (SSO) that employees use everywhere. Having seized the forum server, the researchers used the shared SSO to hijack the ChatGPT and Codex accounts of its members who were OpenAI employees; the victims did not need to do anything. Hacktron emphasizes: this is an OpenAI identity problem, not a forum problem.

The Role of Artificial Intelligence

The hardest part was carried out by AI. For several sessions, Claude Opus 4.8 was unable to build a working exploit with ASLR enabled. On the evening of July 24, Anthropic released Claude Opus 5 — and in a new session the model assembled a working exploit in a matter of hours. The researchers got around the built-in restrictions that prevent it from writing attack code against real targets by passing off their own test server as a training CTF target. That said, they note, the process was not fully automatic: skilled human guidance still played a key role.

OpenAI was just one target in the broader HEIF Heist project: over two months the team found the same type of image-decoding flaws in other people's software, spending less than $3,000 on AI. There is no sign of real-world exploitation of the OpenAI hole.

The takeaways go beyond a single forum: old libheif builds are dangerous anywhere HEIC, HEIF, and AVIF files are accepted, and shared SSO between a public service and internal tools turns a breach of the former into a breach of the latter. The recommendation is to update libheif, disable decoding of untrusted images or isolate processing in a sandbox, and require a fresh identity check before sensitive actions.

Source: The Hacker News