Researchers at security firm Hacktron used Claude to create a working exploit for a vulnerability in an image processing library, then linked it to a vulnerability in OpenAI’s login system to take over employees’ ChatGPT and Codex accounts, and finally gained access to internal code repositories.
The entry point was OpenAI’s community forum, community.openai.com, which runs on Discourse. Discourse’s built-in image checkers did not support the HEIC/HEIF photo format, so uploads in that format were passed to ImageMagick, which revealed an unfixed bug in the libheif library it relies on for decoding.
Hacktron says the underlying bug was fixed by the upstream authors a year earlier without ever being flagged as a security issue, so it was never assigned a CVE and missed the usual patching cycle.
Converting the flaw into a reliable exploit required several attempts involving Claude Opus 4.8 and Opus 5. The exploit enabled remote code execution, which the researchers used first against a test instance of Discourse and then on OpenAI’s own forum.
Because people could log into the forum with their OpenAI account, code execution there opened the way to broader account access. Hacktron says that until the issue is resolved, the ChatGPT and Codex accounts of any users or employees logged into the forum could have been taken over.
Additionally, because people often connect other services to these accounts, the theoretical compromise extended to services such as GitHub, Slack, and email.
OpenAI distinguishes between the two errors. It told Safety Week that the image processing error was in the third-party service Discourse, while the account takeover path was a separate, OpenAI-side issue.
The OpenAI vulnerability was related to login tokens generated for the community forum containing excessive permissions and granting full API access to associated ChatGPT and Codex accounts.
To demonstrate access without reading internal code, Hacktron said it took over the account of an OpenAI employee whose Codex integration was linked to OpenAI’s GitHub organization and then used it to open a pull request in an internal repository before stopping further testing.
OpenAI said its own review of the incident found limited reads of metadata and commits from private repositories following the pull request submitted by the researcher, particularly in a README file.
Hacktron’s report Additionally, Slack represents a service that could theoretically have been accessed through connected accounts. According to OpenAI, Hacktron did not verify actual access to employees’ Slack messages.
The security firm reported the account takeover issue to OpenAI via Bugcrowd, and the AI giant confirmed a fix about 14 hours later. The libheif bug was reported separately to Discourse via HackerOne. Discourse had a fix ready within two days, adding image processing sandboxing as an additional layer of defense, and then released one Safety notice.
In a statement, OpenAI said: “We thank the researchers for contacting us and sharing their findings. We have restricted community login token permissions and revoked affected tokens and sessions.”
The company paid Hacktron a $6,500 bounty for the OpenAI-side find.
Related: OpenAI says its models searched GitHub for leaked API keys during training
Related: AI agents can retrain their own models mid-task, reveal secrets and delete rejections
Related: OpenAI investigates report linking AI agents to RubyGems attack
