Cybersecurity Researchers Uncover Vulnerability in OpenAI’s Sign-In System, Gain Access to Internal Code Repositories
A recent exploit built using artificial intelligence (AI) has raised concerns about the security of even the most advanced systems. Researchers at Hacktron discovered a vulnerability in an image-processing library used by OpenAI’s community forum, which they then chained with a flaw in the company’s sign-in system to gain access to internal code repositories.
The entry point for this exploit was the OpenAI community forum, where users can upload images. However, the forum uses a third-party service called Discourse, which doesn’t support the HEIC/HEIF photo format. As a result, uploads in this format are passed to ImageMagick, an image-processing library that relies on the libheif library for decoding. This is where the vulnerability lies – an unpatched flaw in the libheif library that has been fixed upstream for over a year.
To turn this flaw into a reliable exploit, Hacktron used Claude Opus 4.8 and Opus 5 to build a working exploit. This allowed remote code execution, which the researchers first tested on a test Discourse instance before moving on to OpenAI’s own forum. Since users can sign in to the forum using their OpenAI account credentials, gaining access to the forum gave Hacktron a path to broader account access.
The implications of this vulnerability are serious. Until it was fixed, any user or employee who logged into the forum could have had their ChatGPT and Codex accounts taken over. This is particularly concerning because users often connect other services to these accounts, potentially exposing GitHub, Slack, and email to unauthorized access.
OpenAI has acknowledged two separate flaws: one in the third-party service Discourse, and another on its own side related to sign-in tokens generated for the community forum. These tokens carried excessive permissions, granting full API access to associated ChatGPT and Codex accounts. Hacktron demonstrated this by taking over an OpenAI employee’s account and using it to open a pull request in an internal repository.
In a statement, OpenAI thanked the researchers for contacting them and sharing their findings. The company narrowed the permissions on community sign-in tokens and revoked affected tokens and sessions. A security advisory was also published after Discourse fixed the libheif flaw and added image-processing sandboxing as an extra layer of defense.
This incident serves as a reminder that even AI-powered systems are not immune to vulnerabilities. As we continue to rely more heavily on these systems, it’s essential to prioritize cybersecurity measures and regularly test for potential weaknesses. Users should also be mindful of the services they connect to their accounts and take steps to protect themselves against unauthorized access.
To stay ahead of threats like this one, users should keep software up-to-date, use strong passwords and multi-factor authentication, and monitor their account activity regularly. By taking these precautions, we can mitigate the risks associated with vulnerabilities in even the most advanced systems.
Source: SecurityWeek — 2026-09-18