Researchers use Claude models to chain a HEIF bug and SSO flaw into OpenAI's internal GitHub
Expert_Annual_19 · reddit · 2026-09-18
- Security team Hacktron disclosed a bug chain against community.openai.com: the forum's Discourse shipped an outdated libheif whose upstream fix was never labeled security-related, letting a malicious HEIF image achieve code execution.
- A second flaw in OpenAI's own SSO turned the forum foothold into real ChatGPT and Codex accounts—including OpenAI employees', with Codex wired to Gmail, Outlook, Drive, Slack and GitHub.
- To prove access, researchers had Codex open a harmless PR in an internal OpenAI repo, claiming they read no sensitive code.
- The team says Anthropic's Opus 4.8 found the libheif bug and Opus 5 weaponized it; OpenAI patched the SSO in 14 hours and paid a $6,500 bounty.
- The same team also compromised Slack, Meta, GitHub Enterprise, Rails, Next.js and ImageMagick among others.
More from Safety
- Anthropic says it may imminently hit RSP threshold for AI-accelerated R&D, releases provable inference work — tobyordoxford · 2026-11-04
- Hackers reset French blood service freezers from -30°C to 110°C in supply-chain cyberattack — LuizaJarovsky · 2026-11-04
- Google says it removed post-employment non-disparagement clauses from new-hire terms — HaydnBelfield · 2026-11-04
- Claude doesn't really forget: Anthropic's privacy policy allows records retention up to 7 years — nikola_mr64990 · 2026-11-04
- Polymarket opens a market on Anthropic's next AI sandbox escape — Polymarket · 2026-11-04
- Rival company blames 'AI gone off the rails' after founder catches it hacking his network — AccBalanced · 2026-11-04