A team of three security researchers from Hacktron successfully breached OpenAI's internal systems in under 72 hours. The attack targeted the company's community forum, community.openai.com, and allowed unauthorized access to employee accounts for ChatGPT and Codex, as well as the internal GitHub code repository.
The exploit relied on two vulnerabilities: a flaw in the libheif library used for image processing and a misconfiguration in OpenAI's central single sign-on system. The researchers noted that the libheif vulnerability had a known fix available for a year, but it remained unpatched in the forum's Debian packages.
The researchers utilized Anthropic's Claude Opus 5 model to develop the exploit. While previous versions struggled with memory protection, the new model created a functional exploit within three hours. By framing the attack as a benchmark task to bypass model safety restrictions, the researchers automated the process.
The project, titled HEIF Heist, was conducted over two months with a budget of less than $3,000. The team expanded their investigation to include Slack, Meta, and GitHub Enterprise. OpenAI confirmed the fix 14 hours after receiving the report, and the Discourse software team also addressed the issue shortly thereafter.
