Researchers used Claude to access OpenAI GitHub repository, report says

Hacktron detailed in a blog post that the issue stemmed from two vulnerabilities in OpenAI’s infrastructure. One affected the company’s user forum, while the other was found in the single sign-on, or SSO, system that manages employee accounts. OpenAI’s forum is powered by the open-source discussion board platform Discourse, which lets users upload images as part of their posts. The software processes images with the help of an open-source tool called libheif, and that tool contained the first vulnerability spotted by Hacktron’s researchers.

The vulnerability allows hackers to compromise certain versions of libheif by uploading a malicious image. The malware-laden file causes a buffer overflow, making it possible to edit program data that is normally inaccessible, and hackers can replace that data with malicious code. The developers of libheif patched the issue about a year before Hacktron’s researchers made their discovery, but Discourse did not implement the patch, leaving OpenAI’s forum vulnerable.

Hacktron’s researchers developed the initial version of the exploit on June 23 using Claude Opus 4.8. The proof-of-concept worked in their internal Discourse instance but did not carry over to OpenAI’s forum because it uses a safeguard called ASLR. The technology protects sensitive program data from buffer overflows by spreading it over randomized memory locations.

The researchers’ breakthrough came the following day, when Anthropic released Claude Opus 5. The model quickly found a way around OpenAI’s ASLR implementation. After the researchers gained access to the forum, they found a configuration issue in the SSO system that powers OpenAI employees’ forum accounts. The same SSO system manages staffers’ access to sensitive internal systems.

Hacktron’s researchers notified the company about three hours after they compromised its forum. They then took over an OpenAI employee’s account to map out the scope of the issue, and that account gave them access to the company’s internal GitHub environment.

The libheif vulnerability that exposed OpenAI’s code is one of several exploits in the image processing tool. Hacktron has named the bug series HEIF Heist. The company said it discovered the series in the infrastructure of not only OpenAI but also Slack, Meta Platforms Inc. and other major tech firms. It’s believed HEIF Heist is so widespread because libheif’s developers did not create an entry for the bug series in the CVE vulnerability database, making it harder for developers to detect and patch vulnerable systems. Hacktron is advising affected users to download the latest versions of libheif and harden or disable their image processing pipelines.