White-hat hackers breach OpenAI via Claude-built exploit, access internal codebase

The Hackron AI team, self-described as white-hat hackers operating under OpenAI's bug bounty program, detailed the attack in an X post on September 18. According to the team, their entire breach took less than 72 hours and involved two vulnerabilities chained together: a Remote Code Execution (RCE) flaw via a heap overflow in libheif, and a single sign-on (SSO) misconfiguration in Discourse, the third-party platform hosting OpenAI's community forum.

The exploit chain began when the researchers uploaded a malicious HEIF (High Efficiency Image File) image as a profile picture. Discourse's server-side software processed the image using an outdated libheif package, triggering a heap overflow that crashed the library and mismanaged memory. The researchers orchestrated the memory crash to achieve remote code execution, granting them access to the forum's local server environment. There, they intercepted configuration and session data, uncovering an SSO flaw where authentication did not properly isolate user sessions from other OpenAI services.

Using hijacked session tokens from the local server database, the researchers impersonated a legitimate OpenAI employee, bypassing login screens and infiltrating a highly privileged account linked to the company's development teams. Because many tech companies unify authentication across corporate apps, the compromised account was tied to OpenAI's enterprise systems, including GitHub, Slack, and email. The team then accessed OpenAI's private codebase and initiated a harmless internal pull request as proof.

The attack relied on AI: the researchers built the exploit pipeline using Anthropic's Claude Opus 5 model after attempts with Opus 4.8 failed. After locating the unpatched libheif library, they fed raw server data into the model and asked it to write an exploit. The model analyzed the memory structure and calculated how to trigger the heap buffer overflow.

This incident follows a recent report from an Israeli firm describing a China-linked, AI-powered autonomous cyberattack on Taiwan's government. OpenAI reportedly fixed the reported issues within 14 hours and paid the researchers a $6,500 bounty. Neither OpenAI nor Anthropic has yet issued a public comment on the breach disclosure.

Why This Matters

The hack exposes that even major AI companies are not immune to the same vulnerabilities—like outdated libraries and SSO misconfigurations—that affect any enterprise, and that AI tools can now accelerate vulnerability discovery.
The use of Claude to craft a working exploit highlights the dual-use nature of advanced AI, raising questions about how model safety measures balance against offensive capability.
This incident underscores the growing relevance of human-in-the-loop and autonomous AI-driven offensive security, especially as such techniques are applied against government targets (as in the Taiwan case).

Background

White-hat hacking, or coordinated vulnerability disclosure, is a long-established practice where ethical researchers find and report bugs to vendors, often under formal bug bounty programs. OpenAI, like many large tech firms, runs a public bounty program to reward researchers for finding security flaws. The attack chain—image parser to memory corruption to privilege escalation—is a classic pattern in software exploitation. The novel element here is the use of a commercial AI model to automate the exploit-writing process, a capability that was previously the domain of skilled human reverse engineers. AI-assisted security research is an emerging field, and incidents like this accelerate the debate over whether current safety measures on frontier models are sufficient.

Key Perspectives

Researchers / Cybersecurity Community: The Hackron AI team sees its work as ethical and responsible—they disclosed the findings proactively, demonstrated impact with a harmless PR, and provided enough detail for remediation. Security professionals may argue this case exemplifies the value of bug bounty programs and the maturity of AI tools in offensive research. OpenAI's Security Team: While no official comment has been made, the quick fix (14 hours) and bounty payment suggest OpenAI treats the report seriously and values the disclosure. They may argue that no system is perfect and that their bug bounty program is precisely designed to catch such issues, with the incident highlighting the importance of keeping dependencies updated. Critics and Skeptics: Some may question whether publishing the full exploit chain (the post includes a detailed attack sequence) could help malicious actors. Others may point to the risk of relying on third-party libraries (libheif, Discourse) without rapid patching, and note that SSO flaws across unified identity systems amplify the impact of a single compromised session. There's also concern that AI-generated exploits lower the skill bar for cybercrime.

What to Watch

Whether OpenAI or Anthropic issues an official response, including any changes to bug bounty payouts or acknowledgment of the AI-assisted nature of the exploit.
If similar SSO or libheif vulnerabilities are discovered elsewhere, as the attack technique is now public knowledge.
Regulatory or policy reactions to AI-assisted offensive cyber operations, especially after the Taiwan autonomous attack report.
Whether other bug bounty programs adjust their rules to explicitly address AI-generated exploits, and how vendors patch outdated dependencies more rapidly.
The timing of any patches to Discourse, libheif, or other components mentioned, and if OpenAI has conducted a broader audit of its forum infrastructure.

ZOTPAPER