OpenAI Hacked: Claude AI Used to Breach the Fort

The Hacktron team managed to chain together a couple of vulnerabilities to gain access to OpenAI staff accounts, eventually landing a pull request in a private monorepo in under three days. The whole operation started at the company’s public forum, built on the Discourse platform. The forum had a blind spot: it blindly trusted HEIC image files, passing them directly to the ImageMagick processing tool, which was running an outdated, unpatched version of the libheif library.

By uploading a specifically crafted image, the researchers forced the server to execute their own code. Because OpenAI used a unified login system for its forum, ChatGPT, and Codex, this entry point provided a golden key to internal systems. One staffer even had Codex hooked directly into the company’s GitHub organization. To prove the point, the team successfully pushed a benign pull request into a secure repository before stopping their test.

Crucially, the Claude Opus 5 model was the one that cracked the library's defense, succeeding where its predecessor failed after just three hours of effort. The entire project cost less than three thousand dollars in AI compute time and spanned only two months. While OpenAI patched the hole in under 14 hours and paid a 6,500-dollar bounty, the same bug was later discovered lurking in giants like Slack and GitHub Enterprise.

It turns out the greatest security threat to the future of artificial intelligence is the same dusty code that’s been powering internet forums since the dawn of time. When billion-dollar empires built on cutting-edge models are brought to their knees by a single outdated image library, the fragility of the entire stack becomes uncomfortably clear. Efficiency is grand until the foundation is held together by digital duct tape.

Source: Hacktron