They Hacked OpenAI in 72 Hours (Using Claude)

If your app lets users upload images, here is the exact chain a team used to turn one HEIC upload into remote code execution on OpenAI's servers. A crafted photo slipped past FastImage, was handed to ImageMagick and then to libheif 1.19.7, where a known, unpatched heap overflow ran the attackers' code on OpenAI's public Discourse help forum. From there an SSO misconfiguration converted forum control into a real login token for an employee's OpenAI account, and that employee's connected Codex agent opened a pull request inside OpenAI's private monorepo. Three researchers at Hacktron chained it in under 72 hours, with Claude writing the working exploit in about three hours. 🔔 Subscribe: https://www.youtube.com/channel/UC0DZj1PNa_Fp0MU6uPSKv5w?sub_confirmation=1 💙 Become a Member: https://www.youtube.com/channel/UC0DZj1PNa_Fp0MU6uPSKv5w/join 🐦 Twitter/X: https://x.com/cloud_codes 💬 Discord: https://discord.gg/mhgXXmhrh The video follows that one image through four doors and names the fix that should have stopped each one. Hacktron's write-up documents the full chain, s1r1us shared the thread that surfaced it, and libheif's upstream fix shows the exact overflow Debian had not backported to the version running on community.openai.com. Door one is the HEIC path (FastImage waves it through, ImageMagick delegates to libheif, the overflow gives RCE); door two is the OpenAI SSO flaw that turns forum control into a real account token; door three is a connected Codex opening a pull request in openai/openai. Opus 4.8 first flagged the missing patch and Opus 5 wrote the multi-architecture exploit in about three hours, which is the shift the video argues: the scarce skill to weaponize a memory bug is becoming cheap compute. It also covers transitive dependency risk, why backport latency leaves public bugs live, that the researchers read no source code and filed a harmless proof of concept, OpenAI's roughly 14-hour fix and 6,500 dollar bounty, and the twist that testing the Discourse forum was out of scope, with independent reporting lining up on the same dates and chain. If you build or ship software, this channel breaks down the real mechanism behind each headline: the dependency you did not know you shipped, the identity boundary you assumed was safe, and the integration whose token outlived its task. Subscribe and I will trace another one of these attack chains end to end, one door at a time. Build, solve, deploy. 🔗 Resources Mentioned: • Hacktron AI: Hacking OpenAI (researcher write-up): https://www.hacktron.ai/blog/hacking-openai • s1r1us (@S1r1u5_) X thread on the OpenAI hack: https://x.com/S1r1u5_/status/2100777801335095383 • OpenAI Developer Community forum (Discourse): https://community.openai.com • libheif upstream fix commit (strukturag/libheif): https://github.com/strukturag/libheif/commit/85e21ad44eba931314337300a2376b8d28f085ae • Cybersecurity News: Opus 5 used to exploit OpenAI flaws (independent report): https://cybersecuritynews.com/opus-5-to-help-exploit-openai-flaws/ ⏱️ Chapters: 0:00 - One Upload, Four Doors Into OpenAI 1:10 - Door 1: The Help Forum Upload 2:08 - The Unpatched libheif Overflow 2:51 - Opus 5 Writes the Working Exploit 3:23 - Door 2: The SSO Login Flaw 4:25 - Door 3: Connected Codex to the Repo 5:41 - None of the Bugs Were New 6:06 - The Economics of Attack Flipped 6:45 - The Out-of-Scope Twist 7:12 - The Verdict for Defenders #cybersecurity #openai #claude #anthropic #appsec #aiagents #infosec #softwareengineering #cloudcodes #devops #bugbounty User queries how did researchers get into openai private repo heic image upload remote code execution vulnerability libheif 1.19.7 heap overflow exploit discourse imagemagick libheif vulnerability sso misconfiguration account takeover example transitive dependency vulnerability real world example claude opus 5 write working exploit security research how ai is changing offensive security exploit development connected coding agent github security risk debian backport delay unpatched vulnerability