OpenAI Internal Code Accessed Via AI-Generated Exploit and Sign-In Vulnerability

Your OpenAI accounts can now be protected by more secure sign-in tokens, preventing unauthorized access.

Security researchers at Hacktron successfully accessed internal OpenAI code by exploiting a vulnerability in a third-party image processing library and chaining it with a flaw in OpenAI's sign-in system. The exploit leveraged AI, specifically Claude, to generate code for a vulnerability in the libheif library, which was used on OpenAI's community forum. This allowed remote code execution on the forum, which then enabled the takeover of employee ChatGPT and Codex accounts due to excessive permissions on sign-in tokens. The researchers demonstrated this by opening a pull request on an internal GitHub repository using a compromised employee account. OpenAI confirmed limited metadata and commit reads of private repositories, along with the pull request. The company has since fixed the sign-in token vulnerability and revoked affected tokens, while Discourse patched the libheif flaw. Hacktron received a $6,500 bounty for their findings.

This incident highlights the growing sophistication of AI-assisted cyberattacks, where LLMs are used not just for ideation but for generating functional exploit code. The chaining of a third-party library vulnerability with an authentication flaw demonstrates a complex attack vector that could be replicated against other organizations relying on similar software stacks. The speed of the fix, with OpenAI responding within 14 hours and Discourse within two days, indicates a heightened awareness and rapid response capability within the AI and cybersecurity communities to such threats.

The exploit’s success underscores the critical importance of secure supply chains and diligent patching, even for libraries not explicitly flagged as security issues. It also brings to the forefront the risks associated with overly permissive authentication mechanisms, particularly when integrated with services like ChatGPT and GitHub, which often hold sensitive intellectual property. Organizations must now consider the potential for AI-generated exploits targeting subtle bugs and the broader impact of compromised user accounts on their entire digital ecosystem.