AI Models Used to Exploit Vulnerabilities in OpenAI's Community Forum, Hijacking Employee Accounts
Researchers leveraged Anthropic's Claude AI to exploit a libheif heap buffer overflow in OpenAI's community forum, gaining RCE and accessing an employee's ChatGPT account.
Security researchers have demonstrated a novel attack vector by using Anthropic's Claude AI models to exploit a critical vulnerability in OpenAI's community forum, ultimately leading to the compromise of OpenAI employee accounts.
A trio of researchers from Hacktron discovered a chained exploit that allowed them to gain remote code execution (RCE) on OpenAI's community forum instance, which runs on Discourse. This access was then used to hijack an OpenAI employee's ChatGPT account, which was linked to the organization's GitHub.
The initial entry point was a heap buffer overflow vulnerability within the libheif library, a component used for processing HEIF image files. Due to a lack of HEIF support in the forum's FastImage setup, uploaded HEIF files were processed by ImageMagick, exposing the libheif parser directly to potentially malicious inputs.
Using Claude Opus 4.8, the researchers identified the heap buffer overflow flaw. While an initial attempt to develop an RCE exploit using this model failed on Discourse's default configuration, the subsequent release of Claude Opus 5 enabled them to generate a successful exploit script, achieving RCE on OpenAI's specific instance.
Following the successful RCE, the researchers took control of an OpenAI employee's account, which had Codex connected to OpenAI's GitHub organization. To demonstrate the potential impact without accessing sensitive code, they used the employee's Codex account to open a pull request in OpenAI's internal monorepo before ceasing further testing.
OpenAI responded swiftly, patching the vulnerability within approximately 14 hours of being notified and awarding the Hacktron team a $6,500 bounty. Notably, OpenAI clarified that testing against the Discourse-hosted community forum was outside their official bug bounty program's scope, with the award recognizing the OpenAI-side finding.
Discourse also released a fix, implementing image-processing sandboxing and issuing a security advisory (GHSA-vhm9-85gw-x335) with guidance for patching and rebuilding. This incident highlights the increasing sophistication of AI-assisted attacks and the need for rapid security responses.
The researchers emphasized that such complex operations, which previously required extensive human effort and time, can now be compressed into days using AI tools, underscoring the urgent need for security practices to adapt to evolving attacker capabilities.