Hacktron chained a libheif RCE and an OpenAI SSO flaw to take over employee ChatGPT accounts, reaching the internal monorepo for a $6,500 bounty
- Hacktron researchers chained a libheif heap buffer overflow, a missing Debian security backport, ImageMagick and Discourse image uploads with an OpenAI SSO identity flaw to take over ChatGPT and Codex accounts on community.openai.com.
- To prove access without reading sensitive data, the team used a compromised employee's Codex to open PR #1186742 in OpenAI's internal monorepo openai/openai, claiming the same path could reach GitHub, Slack and email; discovery to repo access took under 72 hours.
- OpenAI confirmed the fix roughly 14 hours after the Bugcrowd report and paid a $6,500 bounty, noting that testing against the Discourse-hosted forum was explicitly excluded from its program.
- Discourse had a fix ready by Monday July 27, added image-processing sandboxing as defense in depth, and published advisory GHSA-vhm9-85gw-x335 on July 28.
- The researchers say Claude did the exploit work: it failed against Opus 4.8, and succeeded the day after Anthropic released Opus 5.
Hacker News opinions
The chain here is wild. A libheif bug, Debian never backporting the fix, ImageMagick, Discourse uploads, then an SSO misconfiguration. That ends with someone sitting in OpenAI's internal monorepo.
$6,500 for this is a joke. Access like that is worth maybe $6.5M on the black market.
That's exactly why people sell to brokers instead of reporting. Doing the right thing pays nothing.
I don't buy the black market number. There's basically no market for a forum RCE, and most brokers wouldn't touch it.
Even so, why would anyone bother with a $6,500 payout for this bug class? Crypto smart contract reports average $100k to $10M.
The blog post is impressive but $6,500 from a company near $1.2T is pathetic. This is close to breaching google3. If unreleased models and training material leaked, it'd be worth tens of millions.
Companies can't hand out $1M per report though, that's not sustainable long term. It's the unfortunate reality of doing the right thing.
What gets me is the Claude part. It failed on Opus 4.8, then Anthropic shipped Opus 5 and the next day it found the exploit. Is hacking just so machine-verifiable that it trains faster than any other domain?
And the libheif situation is a mess. Upstream changed the vulnerable code the previous year, but no CVE and no security note, so Debian 12 and 13 never got the backport in time.