Security researchers in an OpenAI bug bounty program hacked OpenAI, accessing its "monorepo" on GitHub, using a cybersecurity version of Opus 4.8 and Opus 5

You can now access OpenAI's internal GitHub repositories if you can find an SSO misconfiguration and a vulnerable dependency like libheif.

Security researchers from Hacktron AI have successfully breached OpenAI's internal GitHub repositories by chaining two critical vulnerabilities. The exploit chain began with a heap buffer overflow in the libheif image decoder, which was used by Discourse, the platform hosting OpenAI's community forum. This vulnerability allowed remote code execution (RCE) on the forum's environment. Subsequently, a single sign-on (SSO) misconfiguration in OpenAI's identity infrastructure enabled the researchers to compromise ChatGPT and Codex accounts of OpenAI employees. Using these compromised accounts, they gained access to internal OpenAI repositories, including the company's monorepo on GitHub. The researchers performed a proof-of-concept by opening a pull request within the monorepo. The entire process, from initial discovery to accessing internal repositories, took less than 72 hours. OpenAI has since patched the vulnerabilities and awarded the researchers a $6,500 bounty for the OpenAI-side findings, though testing against the Discourse-hosted forum was outside the bounty program's scope.

The incident highlights a critical dependency risk in the software supply chain, as a vulnerability in a widely used, seemingly innocuous library like libheif can lead to significant breaches at major AI companies. The fact that the exploit chain was completed within 72 hours, with the assistance of advanced AI models like Claude Opus 5, underscores the escalating speed and sophistication of cyberattacks. This also points to the increasing reliance of attackers on AI tools to discover and weaponize vulnerabilities, potentially lowering the barrier to entry for complex exploits.

This event signals a broader trend of AI-powered vulnerability discovery and exploitation, which will likely pressure companies to adopt more proactive and integrated security measures. The ease with which researchers could chain together a dependency exploit with an SSO misconfiguration suggests that the attack surface for AI companies remains vast and interconnected, demanding a holistic security strategy. Organizations should anticipate an increase in AI-assisted attacks targeting third-party dependencies and identity management systems, necessitating continuous security audits and rapid patching.