Three Hackers Breached OpenAI Internal Repos in 3 Days Using Claude for $3K
marcvanderchijs · x · 2026-09-21
Security team Hacktron AI disclosed that on July 25, 2026, they chained two critical vulnerabilities in under 72 hours — at roughly $3,000 in token costs — to compromise multiple OpenAI employees' ChatGPT accounts and reach internal OpenAI repositories.
Exploit chain:
- Heap buffer overflow in the libheif image decoder (missing Debian security backport; ImageMagick uses libheif; Discourse uses it for image uploads)
- SSO identity flaw in OpenAI's own forum, community.openai.com
- Access via ChatGPT / Codex accounts to connected integrations like GitHub, reaching internal repos
Proof: To demonstrate access without reading sensitive data, they used an employee's Codex to open PR #1186742 in OpenAI's internal monorepo.
The team reported to OpenAI and Discourse immediately and coordinated the patch; OpenAI paid a $6,500 bounty. The reposter notes that if three people can hack OpenAI in three days for $3,000, many banks are at risk too.
More from Safety
- Agent Swarms Are Autonomously Hacking Critical Infrastructure Run by Underpaid Devs — menhguin · 2026-11-12
- Researcher says Anthropic dodged questions on Mythos false positive rate; 37,966 findings, 2 exploited — OwariDa · 2026-11-12
- Who reads the queries your agent writes? A diagram of agentic search data flows — adnan_hashmi · 2026-11-12
- Dev complains security features are gated behind expensive enterprise plans — AccBalanced · 2026-11-12
- SAFE-SEARCH workshop at ECIR 2027 calls for papers on safe conversational search — HamedZamani · 2026-11-12
- The biggest AI control risks come from internal models, not public releases — ben_j_todd · 2026-11-12