Three security researchers from Hacktron AI breached OpenAI's internal code repository in less than 72 hours on July 25 using a chain of two vulnerabilities. The team gained access to ChatGPT and Codex accounts belonging to OpenAI employees, which enabled them to submit a harmless pull request to the company's internal GitHub monorepo. OpenAI paid the researchers a $6,500 bug bounty and patched a single sign-on flaw within 14 hours of the report.
The attack exploited a heap overflow in libheif, an image library used by OpenAI's Discourse hosted community forum. Hacktron AI's HEIF Heist investigation identified vulnerabilities in libheif affecting Meta, Slack, and GitHub Enterprise that could lead to remote code execution. The researchers used Anthropic's Claude Opus 5 to produce a working exploit within three hours of the model's release, after the previous Opus 4.8 model failed to do so.
Key sources
- SOURCE@rootxharsh“disclosing HEIF Heist, a months-long investigation into libheif that allowed us to hack OpenAI, Slack, Meta, GitHub Ent, Rails, Next.js, ImageMagick, and many more”x.com
- SUPPORT@hacktronai“Two vulnerabilities chained together gave us access to ChatGPT and Codex accounts belonging to OpenAI employees”x.com
- SUPPORT@nahamsec“disclosing HEIF Heist, a months-long investigation into libheif that allowed us to hack OpenAI, Slack, Meta, GitHub E…”x.com
- SOURCE@gauravisnotme“On July 25, we hacked OpenAI.”x.com
- SUPPORT@peterwildeford“As proof, they told that employee's Codex to open a harmless pull request (a proposed code change) in OpenAI's internal monorepo, then stopped.”x.com
- SUPPORT@ziv_ravid“Two bugs let us take over ChatGPT/Codex accounts of OpenAI employees (+some unaffiliated users) and reach connected services: Outlook, Slack, GitHub, etc.”x.com
- SUPPORT@mtslive“It cost under $3,000 in tokens. OpenAI fixed it in 14 hours and paid $6,500”x.com
- SUPPORT@jachiam0“multiple labs use slack, we could've leaked every private images and other files uploaded to slack”x.com