A heap overflow and SSO misconfiguration to compromise OpenAI internal repos

	A heap overflow and SSO misconfiguration to compromise OpenAI internal repos(hacktron.ai)
	484 points by Handy-Man 26 days ago \| 206 comments
	tl;dr: Researchers at Hacktron chained a heap overflow in libheif (exploitable via image uploads to Discourse, which OpenAI's community forum runs on) with an OpenAI SSO misconfiguration to take over employee ChatGPT/Codex accounts and open a PR in OpenAI's internal monorepo—all within 72 hours, earning a $6,500 bounty. They leaned heavily on Claude Opus 5, which produced a reliable ASLR-enabled exploit within hours of release after Opus 4.8 had failed. The authors argue AI is collapsing the cost of weaponizing known memory-corruption bugs, eroding the "security through complexity" that previously protected typical targets.
	HN Discussion: ↑Attack surface of image parsers like libheif/ImageMagick is too large and needs safer alternatives or sandboxing ~Bounty amount is insultingly low compared to black market value of such an exploit chain ↑Bloated code and unsafe languages are the root problem; we need less software and safer languages like Rust ↑Curiosity about how AI models achieved this capability so quickly, possibly due to machine-verifiable training signals •Tangential wonder at why AI model weights themselves have never leaked despite lax security elsewhere