3-person team used Claude to breach OpenAI's internal repo in 72 hours
量子位 · wechat · 2026-09-18
The 3-person HacktronAI team spent under 72 hours and under $3,000 in tokens to go from OpenAI's Discourse forum to its internal monorepo. The chain started with an unassigned-CVE heap overflow in libheif (invoked via ImageMagick for HEIC/HEIF uploads) achieving RCE, then an OpenAI SSO auth flaw let them take over ChatGPT/Codex accounts of forum users including OpenAI staff, verified via a harmless PR from an employee's Codex.
AI was central: Claude Opus 4.8 found the flaw but failed against ASLR; Opus 5 produced a working exploit within 3 hours and, in an autonomous loop, compromised their test instance overnight. GPT-5.6 Sol showed stronger adaptation on unknown targets. OpenAI fixed the SSO issue in 14 hours and paid a $6,500 bounty.
The extended HEIF Heist research found the same libheif flaw affects Slack, Meta, GitHub Enterprise and multiple Node.js frameworks; only Shopify detected the activity. The piece argues AI is turning scarce exploitation expertise into purchasable compute — complexity-as-security is failing.
More from Fun
- OpenAI DevDay demo shows forking agent task history at any step — paw_lean · 2026-11-04
- Founder gave his AI his inbox to raise $10M; first tweet hit 100K views — LinusEkenstam · 2026-11-04
- Reddit user claims Codex gets 'dumbed down' right before each OpenAI release — blackcid6 · 2026-11-04
- Waymo's expanded LA service area reaches SpaceX HQ for the first time, $67.15 ride — reed · 2026-11-04
- Karpathy Boosts Open Hacker News Dataset: 10M+ Posts Usable as a Personal Knowledge Base — huangyun_122 · 2026-11-04
- Agent silently completed only a quarter of a 200-module build and stalled waiting for confirmation — Promptmethus · 2026-11-04