White-hat team exploits OpenAI's SSO and forum flaw to reach internal code
Researchers from Hackron AI gained access to OpenAI's internal systems by chaining a heap overflow in the forum software with a single sign-on misconfiguration. They accessed employee ChatGPT and Codex accounts and demonstrated the breach with a harmless pull request before reporting it. OpenAI fixed the issue within 14 hours and paid a $6,500 bounty.
The attack chain began with a malicious HEIF image uploaded as a forum profile picture, triggering a heap overflow in an outdated libheif package that enabled remote code execution. From there, the researchers exploited an SSO misconfiguration to hijack session tokens and impersonate an OpenAI employee, gaining entry to ChatGPT, Codex, GitHub, and Slack accounts tied to the company's development teams.
The Hackron AI team constructed the exploit pipeline using Anthropic's Claude Opus 5 model after earlier attempts with Opus 4.8 failed. They proved the breach with a harmless pull request in OpenAI's internal monorepo, and OpenAI patched the vulnerabilities within 14 hours, paying a $6,500 bounty. The incident echoes a recent autonomous AI-driven cyberattack on Taiwan's government, highlighting AI's growing role in offensive security research.
This incident could signal a shift in how organizations assess third-party software dependencies and SSO configurations, as AI-assisted tooling makes sophisticated exploit chains faster to assemble. Companies may need to weigh whether current bug bounty payouts adequately reflect the severity of chained vulnerabilities. For the broader public, it underscores that even major AI firms remain exposed to the same foundational flaws as smaller organizations, potentially influencing how users trust enterprise AI services with sensitive data.