Codex

Everything

Opus

Human

<p>Hacktron AI says it managed to hack OpenAI in less than 72 hours. The security research team revealed that it chained two separate vulnerabilities to gain access to ChatGPT and Codex accounts belonging to OpenAI employees. To prove the access was real, the researchers used an employee’s Codex account to open a harmless pull request in OpenAI’s internal monorepo rather than accessing sensitive code. The entire attack started with something that sounds relatively harmless: uploading an image.</p>
<p>Hacktron shared the details in a technical write-up on September 13, while also summarizing the exploit chain on X.</p>
<div class="ose-x ose-uid-2ffdd0b4bb48df8de03a324bbc0a709c ose-embedpress-responsive" style="width: 100%; height:550px; max-height:550px; max-width:100%; display:inline-block;">
 <blockquote class="twitter-tweet">
  <p>On July 25, our team hacked OpenAI. <br><br>It took us less than 72 hours.<br><br>Two vulnerabilities chained together gave us access to ChatGPT and Codex accounts belonging to OpenAI employees. We demonstrated the impact with a harmless PR in OpenAI’s internal monorepo.<br><br>The full chain:…</p>— Hacktron AI (@HacktronAI) <a href="https://x.com/HacktronAI/status/2100795824812777893?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">September 18, 2026</a>
 </blockquote>
</div>
<p>According to the researchers, the chain looked like this:</p>
<ul>
 <li><b>HEIF upload</b> → <b>libheif</b> heap overflow → remote code execution → OpenAI SSO flaw → ChatGPT/Codex takeover → connected GitHub → internal repository</li>
</ul>
<h2 id="key-takeaways">Key Takeaways</h2>
<ul>
 <li>Hacktron AI says it compromised OpenAI systems in less than 72 hours.</li>
 <li>The attack began with a HEIF image upload and a vulnerability in libheif.</li>
 <li>An OpenAI SSO flaw allegedly allowed the researchers to move from the compromised forum to employee ChatGPT and Codex accounts.</li>
 <li>A connected GitHub integration provided a path to demonstrate access to OpenAI’s internal repository.</li>
 <li>OpenAI says it fixed its side of the issue about 14 hours after the report and later paid Hacktron a $6,500 bounty.</li>
 <li>The research highlights how AI can accelerate vulnerability research and exploit development, although Hacktron says human guidance was still necessary.</li>
</ul>
<h2 id="the-hack-started-with-a-heif-image">The Hack Started With a Heif Image</h2>
<p>Hacktron was looking at the image-upload system used by OpenAI’s community forum, which runs on Discourse. The researchers noticed that HEIC and HEIF images were processed differently from other image formats. Because Discourse’s usual image-checking tool did not support HEIF, those files were passed to ImageMagick for conversion.</p>
<p>That meant the uploaded files eventually reached libheif, an image-processing library responsible for handling the format. Hacktron then discovered a heap buffer overflow in the version of libheif used by the environment.</p>
<p>According to the team, some security fixes had not been backported to the Debian package. This left the library vulnerable to a memory corruption attack that could provide out-of-bounds read and write capabilities. In other words, a specially crafted image could become much more than just an image.</p>
<h2 id="ai-helped-turn-the-bug-into-an-exploit">AI Helped Turn the Bug Into an Exploit</h2>
<p>This is where the story gets particularly interesting. Hacktron says it used AI models to help investigate and exploit the vulnerability.</p>
<p>The researchers initially worked with Claude Opus 4.8, asking it to examine the installed libheif package for potential security problems. The model helped identify the relevant vulnerability, but getting a reliable exploit working proved difficult when ASLR was enabled.</p>
<p>Then Anthropic released Claude Opus 5. Hacktron says the new model was able to produce a working ARM64 exploit within about three hours. The researchers then had it adapt the exploit to the x86-64 environment and the jemalloc configuration used by Discourse.</p>
<p>By the morning of July 25, the team says it had confirmed remote code execution through an image upload. And that was only the beginning.</p>
<h2 id="the-openai-sso-flaw-changed-everything">The Openai SSO Flaw Changed Everything</h2>
<p>Getting code execution on the forum wasn’t enough to reach OpenAI employee accounts. Hacktron discovered that the forum supported “Sign in with OpenAI” through OpenAI’s authentication infrastructure at auth.openai.com. The researchers believed this SSO setup could provide a route from a compromised forum account into other OpenAI services.</p>
<p>According to Hacktron, they were able to confirm that assumption. The researchers said they took over an OpenAI employee’s ChatGPT and Codex accounts. That employee’s Codex account was connected to OpenAI’s GitHub organization.</p>
<p>Rather than digging through OpenAI’s internal source code, Hacktron used the compromised Codex account to create a pull request in OpenAI’s internal monorepo. The team described the pull request as a harmless proof of concept and stopped testing after demonstrating the access.</p>
<h2 id="openai-fixed-the-issue-within-hours">OpenAI Fixed the Issue Within Hours</h2>
<p>Hacktron reported its findings to OpenAI through the Bugcrowd bug bounty program on July 25. According to the team’s timeline, OpenAI confirmed that its side of the issue had been fixed at around 22:49 UTC, roughly 14 hours after the initial report.</p>
<p>The researchers also reported the underlying Discourse vulnerability to Discourse through HackerOne. Discourse responded the next day and had a fix ready by July 27. The company also added sandboxing for ImageMagick as an additional security measure.</p>
<p>OpenAI later awarded Hacktron a $6,500 bounty for the OpenAI-side vulnerability. OpenAI clarified that testing against the Discourse-hosted community forum was outside the scope of its bug bounty program.</p>
<h2 id="the-bigger-concern-is-ai-assisted-hacking">The Bigger Concern Is AI-Assisted Hacking</h2>
<p>For Hacktron, this wasn’t just another vulnerability disclosure. The researchers say the experiment shows how AI is changing the amount of time and expertise required to turn vulnerabilities into working exploits.</p>
<p>Hacktron said the OpenAI and Discourse attack took a few days for an AI agent and only a few hours of human effort. Its broader HEIF Heist research reportedly involved three researchers and cost less than $3,000 in AI tokens.</p>
<p>The team is careful to point out that the process wasn’t completely autonomous. Human researchers still provided guidance and made important decisions during the operation. Still, the speed is notable. Hacktron argues that tasks that once required highly specialized security expertise and significant amounts of time can increasingly be accelerated by AI.</p>
<p>The incident also shows why vulnerabilities in seemingly ordinary software can have much wider consequences when that software is connected to authentication systems and other services.</p>
<p>This article was originally published as <a href="https://www.cryptobreaking.com/hacktron-says-it-hacked-openai/?utm_source=rss&amp;utm_medium=syndication&amp;utm_campaign=article_footer" rel="noopener noreferrer nofollow">Hacktron Says It Hacked Openai in Under 72 Hours</a> on <a href="https://www.cryptobreaking.com/?utm_source=rss&amp;utm_medium=syndication&amp;utm_campaign=article_footer" rel="noopener noreferrer nofollow">Crypto Breaking News</a> – your trusted source for crypto news, Bitcoin news, and blockchain updates.</p>

Hacktron Says It Hacked Openai in Under 72 Hours

Table of Contents

Crypto Breaking News

Other articles published on Sep 18, 2026

Join our free newsletter for daily crypto updates!