AI-Assisted Security Researcher Chain Exposes OpenAI Employee Accounts and Internal Repository
Security researchers at Hacktron have demonstrated how two vulnerabilities could be chained to compromise the ChatGPT and Codex accounts of several OpenAI employees and gain access to an internal OpenAI code repository.
The researchers used Anthropic's Claude Opus 5 to assist with developing an exploit chain that began with a vulnerability in software used by OpenAI's public help forum and ultimately reached OpenAI's internal authentication environment.
The activity was conducted as security research rather than a real-world attack. Hacktron reported the vulnerabilities to OpenAI, demonstrated access using a harmless pull request, and stopped further testing.
According to Hacktron, the researchers reached the internal repository in less than 72 hours from the initial discovery.
OpenAI reportedly confirmed a fix approximately 14 hours after receiving the report and paid Hacktron a $6,500 bug bounty on September 1.
OpenAI clarified that the bounty recognized the OpenAI-side vulnerability and not the researchers' testing of Discourse, the open-source software used to operate the forum.
Attack Chain Started With an Image Processing Vulnerability
The attack began with a vulnerability in Discourse, the software powering OpenAI's public help forum.
The forum accepts image uploads and uses ImageMagick together with the libheif library to process HEIC and HEIF images.
A vulnerability in libheif could be triggered using a specially crafted image.
The issue is tracked as CVE-2026-32882. Discourse's security advisory describes the vulnerability as capable of remote code execution and assigns it a CVSS score of 8.8.
However, the public vulnerability record for libheif describes CVE-2026-32882 more narrowly as an out-of-bounds read that could result in a crash or disclosure of nearby memory.
Hacktron said it combined multiple memory corruption techniques to turn the vulnerability into working code execution against the forum environment.
The researchers also used information disclosed through the memory vulnerability to help bypass Address Space Layout Randomization (ASLR), a security mechanism designed to make exploitation more difficult.
The underlying libheif vulnerability had already been fixed upstream in libheif 1.22.0, released in May 2026.
However, according to Hacktron, the Debian 12-based server image used by the forum was still running the older libheif 1.19.7 when the researchers tested it in July.
Compromise of the Forum Led to OpenAI Accounts
The researchers then identified an important connection between OpenAI's public forum and its internal services.
The forum provides a Sign in with OpenAI option, using the same single sign-on infrastructure that OpenAI employees use to access other services.
After gaining control of the forum server, the researchers were able to leverage this shared authentication environment to access the ChatGPT and Codex accounts associated with OpenAI employees who were forum members.
The employees did not need to click anything or take an action for the researchers to demonstrate the account takeover.
Hacktron said the issue was related to OpenAI's identity and authentication architecture rather than being a direct vulnerability in the forum software.
The researchers argued that another service integrated with the same authentication system could potentially have created a similar attack path.
Internal OpenAI Repository Access Demonstrated
The compromised accounts provided access to OpenAI's internal development environment.
During the demonstration, a link associated with an employee's Codex access to an OpenAI GitHub repository was opened.
The action resulted in a single pull request being created in the internal repository.
Hacktron said it did not read source code, merge changes, deploy code, access customer information, or modify production systems.
The researchers deliberately limited their activity to demonstrating that the authentication chain could reach an internal repository.
Potential Access to Other Connected Services
The researchers noted that employees often connect multiple services to ChatGPT and Codex.
As a result, the same account compromise could potentially have provided access to other services such as:
- GitHub
- Slack
- Development tools
- Internal collaboration systems
However, Hacktron said these additional services were not accessed during the research.
The broader potential impact therefore represents what the researchers believed the access could have enabled rather than confirmed actions performed during the test.
AI Assisted Exploit Development
A major aspect of the research was the use of artificial intelligence to assist with exploit development.
Hacktron initially worked with Claude Opus 4.8, but the researchers said the model struggled to produce a working exploit against a target protected by ASLR.
After Anthropic released Claude Opus 5 on July 24, the researchers started a new session and reported that the model produced a working exploit within several hours.
The researchers did not describe the process as completely autonomous.
Human researchers provided direction, configured the testing environment, and supervised the AI-assisted process.
To work around the model's safety restrictions, the researchers reportedly presented their own testing environment as a capture-the-flag style target rather than a real-world production system.
The case illustrates how increasingly capable AI models can assist security researchers with complex vulnerability analysis and exploit development.
Wider HEIF Heist Research
The OpenAI incident was part of a larger research project conducted by Hacktron called HEIF Heist.
Over approximately two months, the researchers said they investigated vulnerabilities in software responsible for processing image formats such as HEIF and AVIF.
Hacktron reported finding vulnerabilities affecting software and services used by several major technology companies.
The researchers estimated that their AI usage across the broader research campaign cost less than $3,000.
However, the evidence supporting the broader claims varies between cases, and not every reported exploitation scenario has been independently confirmed.
Importance of Image Processing Security
The research highlights the security risks associated with processing untrusted image files.
Applications that accept HEIC, HEIF, or AVIF files often rely on third-party libraries to decode and process them.
A vulnerable image-processing component can potentially provide an attacker with an entry point into otherwise protected systems.
Organizations that operate their own Discourse installations should ensure that underlying operating system packages and image-processing libraries are fully updated.
The fixed self-hosted Discourse releases identified by the researchers include:
- 2026.7.0
- 2026.6.1
- 2026.5.2
- 2026.1.6
Sites hosted directly by Discourse were reportedly already patched.
Security Recommendations
Organizations using libheif or other image-processing libraries should ensure that vulnerable versions are replaced with patched builds.
Recommended security measures include:
- Update libheif to the latest available security release or the patched version provided by the operating system vendor.
- Disable unnecessary processing of untrusted HEIF and AVIF files.
- Run image-processing workloads inside isolated environments.
- Keep operating system packages and third-party libraries updated.
- Restrict which external services can use corporate single sign-on.
- Require additional authentication for sensitive administrative actions.
- Avoid allowing a lower-trust public service to automatically inherit access to highly privileged internal systems.
- Review connected applications and third-party integrations associated with employee accounts.
There is currently no indication that the OpenAI vulnerability chain was used in a real-world attack.
The research nevertheless demonstrates how a vulnerability in a seemingly lower-risk public-facing service can potentially become a stepping stone toward internal accounts when authentication systems and trusted services are closely connected.
It also highlights the growing role of AI-assisted security research, where advanced AI models can significantly accelerate complex vulnerability analysis while skilled human researchers continue to provide oversight and direction.
