Hacking OpenAI: heap overflow plus SSO flaw gave access to internal repos in 72 hours
dotey · x · 2026-09-18
Security researchers Harsh Jaiswal, Mohan Pedhapati and Rahul Maini (Hacktron AI) disclosed how they chained two vulnerabilities on July 25, 2026 to take over multiple OpenAI employees' ChatGPT accounts — the entire chain from discovery to internal repo access took under 72 hours.
- Exploit chain: a heap buffer overflow in libheif (with a missing Debian security backport, consumed via ImageMagick) → image uploads on OpenAI's Discourse forum (community.openai.com) → an SSO identity misconfiguration → employee ChatGPT/Codex account takeover → GitHub integration → access to OpenAI's internal monorepo.
- Proof of impact without reading sensitive data: they used a compromised employee's Codex to open PR #1186742 in the internal openai/openai repo.
- Because employees connect GitHub, Slack and email to Codex/ChatGPT, the theoretical blast radius was huge.
- They reported immediately, coordinated patches with OpenAI and Discourse, and received a $6,500 bounty. Full disclosure timeline included in the writeup.
More from Safety
- Anthropic says it may imminently hit RSP threshold for AI-accelerated R&D, releases provable inference work — tobyordoxford · 2026-11-04
- Hackers reset French blood service freezers from -30°C to 110°C in supply-chain cyberattack — LuizaJarovsky · 2026-11-04
- Google says it removed post-employment non-disparagement clauses from new-hire terms — HaydnBelfield · 2026-11-04
- Claude doesn't really forget: Anthropic's privacy policy allows records retention up to 7 years — nikola_mr64990 · 2026-11-04
- Polymarket opens a market on Anthropic's next AI sandbox escape — Polymarket · 2026-11-04
- Rival company blames 'AI gone off the rails' after founder catches it hacking his network — AccBalanced · 2026-11-04