Security researchers say two OpenAI forum vulnerabilities allowed them to run code on the platform’s server. They could then take over linked ChatGPT and Codex accounts through OpenAI’s single sign-on system.
Researchers Compromise OpenAI Community Forum
Hacktron AI researchers Harsh Jaiswal, Mohan Pedhapati and Rahul Maini discovered the security weaknesses.
They targeted OpenAI’s community forum, which uses the open-source Discourse platform. The forum also allows users and employees to sign in with their OpenAI accounts.
The team said it took less than 72 hours to move from the initial discovery to demonstrating access to an internal OpenAI code repository.
However, the researchers stressed that they did not use their access to collect sensitive information. They later reported the vulnerabilities to OpenAI and Discourse.
Malicious Image Enables Code Execution
The initial vulnerability affected the forum’s image-upload process. In particular, the researchers focused on HEIC and HEIF image files.
Discourse normally uses the FastImage library to inspect uploaded images. However, FastImage did not support HEIF files.
As a result, the platform sent those files to ImageMagick for conversion. This process exposed the underlying libheif image parser to malicious uploads.
The researchers discovered a heap buffer overflow in the libheif version included with the Discourse Docker image. They said the flaw provided the memory access needed to build a remote code execution exploit.
Consequently, a specially crafted image could allow an attacker to execute commands on the forum server.
Claude Helps Researchers Build Exploit
The Hacktron AI team used Anthropic’s Claude models to help develop the exploit.
On July 24, the researchers asked Claude Opus 4.8 to create a working attack. However, that attempt failed.
They tried again after Anthropic released Claude Opus 5. According to the researchers, the newer model produced a working ARM64 exploit for a local Mac within three hours.
The team then asked Claude to adapt the exploit for the x86-64 environment and jemalloc configuration used by Discourse.
On July 25, the researchers confirmed remote code execution through an image upload. First, they tested the technique against their own Discourse Cloud environment. They then used it against OpenAI’s community forum.
The researchers said AI models also helped with privilege escalation, lateral movement and defence bypasses in restricted environments.
Still, they emphasised that the project did not involve completely autonomous hacking. Skilled human guidance remained essential throughout the research.
The entire project reportedly cost less than $3,000 in AI tokens.
Single Sign-On Exposed ChatGPT and Codex
After compromising the forum, the researchers examined OpenAI’s single sign-on configuration.
They found a separate path that could let them take over the ChatGPT and Codex accounts of active forum members. This risk also applied to OpenAI employees who had signed in to the forum.
Therefore, the OpenAI forum vulnerabilities created risks beyond the community platform itself.
An affected Codex account could also provide access to connected third-party services. The potential reach depended on which services each user had linked.
These services could include GitHub, Slack and email accounts. Consequently, an attacker might gain access to private messages, source code and sensitive files.
Researchers Reach Internal Code Repository
The researchers demonstrated the potential impact through a compromised OpenAI employee account.
That employee’s Codex account had a connection to OpenAI’s GitHub environment. The team then instructed Codex to create a pull request in the company’s internal monorepo.
A monorepo stores source code from multiple projects in one central repository. Therefore, unauthorised access could expose valuable internal systems and development work.
However, the researchers said they did not retrieve sensitive information through this access. Their demonstration aimed to prove the severity of the account takeover chain.
OpenAI Fixes Issue Within 14 Hours
Hacktron AI disclosed the findings to both OpenAI and Discourse.
According to the researchers, OpenAI fixed its part of the vulnerability chain within approximately 14 hours. The company later awarded the team a $6,500 bug bounty.
Meanwhile, Discourse prepared its own fix within several days. It also added stronger sandboxing around image processing to limit the impact of future flaws.
The additional isolation can prevent an image-processing vulnerability from providing access to the wider forum environment.
Research Shows Growing Role of AI in Cybersecurity
The case demonstrates how AI coding models can accelerate complex security research. A small team used Claude to develop and adapt an exploit across different processor architectures and technical environments.
Nevertheless, the researchers still needed specialist knowledge to guide the model, test its output and connect the individual attack stages.
The findings also highlight the risks of connecting multiple services through a shared identity system. A vulnerability in a community forum can become far more serious when the same login links to development tools, source-code repositories and communication platforms.
0 responses to “OpenAI Forum Vulnerabilities Exposed ChatGPT Accounts”