AI-Built Exploit Targeted OpenAI Forum Through Discourse Flaw

Researchers at Hacktron used Anthropic’s Claude models to develop a working exploit for an unpatched flaw in the libheif library, which Discourse used to process HEIC/HEIF images uploaded to OpenAI’s community forum. The upstream bug had reportedly been fixed about a year earlier without being identified as a security issue, so it had not received a CVE or entered the normal patching cycle. The exploit enabled remote code execution and was first tested against a separate Discourse installation before being used against OpenAI’s forum.

Hacktron then chained the issue with a separate OpenAI sign-in flaw. Tokens issued when users signed into the forum with their OpenAI accounts carried excessive permissions, including full API access to associated ChatGPT and Codex accounts. The researchers said this could have enabled takeover of accounts belonging to users or employees, with connected services such as GitHub, Slack and email theoretically also exposed.

To demonstrate the impact, they accessed an employee account whose Codex integration was linked to OpenAI’s GitHub organisation and opened a pull request in an internal repository. OpenAI said its review found limited reads of private-repository metadata and commits, followed by a researcher-created pull request affecting only a README; it said Slack message access was not verified.

Hacktron reported the account issue through Bugcrowd, and OpenAI confirmed a fix roughly 14 hours later, narrowing token permissions and revoking affected tokens and sessions. OpenAI paid a $6,500 bounty. Discourse prepared a fix within two days, added image-processing sandboxing and published a security advisory for the libheif-related issue.