A heap overflow and SSO misconfiguration to compromise OpenAI internal repos
Points and comments are a snapshot, not live.
Researchers chained a libheif heap overflow and OpenAI SSO flaw to access internal repos.
Using Claude Opus 5, Hacktron researchers chained a heap buffer overflow in Debian's libheif (used by ImageMagick in Discourse) with an OpenAI SSO misconfiguration. They achieved remote code execution on community.openai.com via image upload, then took over ChatGPT/Codex accounts whose GitHub integration gave access to OpenAI's internal monorepo. They opened a PR to prove access. OpenAI paid a $6,500 bounty. Timeline: under 72 hours. The team notes AI is compressing previously expensive exploit work into days, urging security assumptions to catch up.
What commenters are saying
The bounty of $6,500 drew scorn as too low for a near-$1.2T company's breach. Commenters argued the black market value for OpenAI's source code and model weights would be millions. Others countered that server-side vulnerabilities have limited resale value because they are worthless once patched, and that actual theft of data constitutes a heist, not a vulnerability sale. A minority noted the SSO flaw-allowing a forum ID token to access GitHub-was the real story, not the heap overflow. On LLM guardrails, several pointed out the researchers tricked Claude by framing the target as a CTF server.