Claude Was Tapped, and OpenAI Was Breached… Is AI Dismantling the “Expert-Only” World of Hacking?
IT DAILY ·
✦ AI Summary
AI could lower the barrier to entry for cyberattacks and reduce their cost and time.
Security researchers used Anthropic's Claude and OpenAI's GPT-5.6 Sol, among others, to demonstrate within 72 hours an attack path leading from an OpenAI employee account to an internal code repository.
The researchers did not view or leak internal source code, and Discourse and OpenAI carried out fixes and responses to the relevant vulnerabilities.
AI could lower the barrier to entry for cyberattacks that once required deep expertise, making it possible to carry out attack procedures with fewer people and in less time. Concerns have also emerged that AI could sharply reduce the cost and time involved in cyberattacks.
As an example, three security researchers used Anthropic's AI model Claude to demonstrate, within 72 hours, an attack path from an OpenAI employee account to an internal code repository. The process was presented as a case showing that even a small group of researchers could potentially connect the entire attack chain.
The researchers used a commercial AI model to analyze image file vulnerabilities, write attack code, steal accounts, and access an internal development environment. However, they did not carry out any viewing or leaking of OpenAI's internal source code.
U.S. security startup Hacktron AI recently released a report titled 'Hacking OpenAI.' Hacktron AI said it used an image-processing library vulnerability to access an OpenAI employee's ChatGPT account and also gained access to an OpenAI employee's Codex account.
The intrusion began with a single photo. The researchers started from Discourse, the external forum solution OpenAI uses to operate its developer community, and exploited weaknesses in the HEIC and HEIF image-processing workflow. The targeted vulnerability was in Discourse's processing of user-uploaded HEIC and HEIF files.
Discourse's HEIC and HEIF conversion tool was ImageMagick, and that conversion process called a vulnerable version of libheif. The reason that vulnerable version was used was that the relevant security fix had not been applied promptly to the Debian operating system in Discourse's container-based environment.
Anthropic's Claude Opus 4.8 and Opus 5 were used in developing the OpenAI and Discourse attack code. The scope of the research later expanded to Slack and Meta, among others.
GPT-5.6 Sol from OpenAI was also used in the broader 'HEIF Heist' research.
It was shown that if an attacker uploads a manipulated image file, memory corruption can occur during the server's conversion and preview-generation process, information can leak in the same process, and remote code execution (RCE) can also be possible. Hacktron AI named this image-processing library attack 'HEIF Heist.'
The researchers began analyzing Discourse's image-upload handling path on July 23. Claude Opus 4.8 wrote attack code that worked in an environment with ASLR disabled, but it failed to produce stable exploit code in the default Discourse security configuration.
The situation changed after the release of Opus 5. According to the researchers, Opus 5 wrote working exploit code for a local environment within hours of release, and the attack code it generated was then adapted for the Discourse server environment. The researchers then ran an AI agent in their own Discourse cloud environment and succeeded in remote code execution there.
Using AI-generated exploit code, the researchers first breached OpenAI's community Discourse environment. They then secured remote code execution in the Discourse environment and also secured administrator privileges there. This result came two days after the initial analysis began.
The forum vulnerability did not end with a compromise of the Discourse server. The forum login credentials of OpenAI account users were tied to a single sign-on (SSO) structure connected to ChatGPT and Codex accounts. That SSO structure became the next attack path.
Hacktron AI said that if the target was a user with a history of forum access, access to ChatGPT and Codex accounts would be possible without any additional clicks or input. Hacktron AI also said, in effect, that even users with only a forum access history could access their ChatGPT and Codex accounts without separate interaction.
Using this method, the researchers secured access to one OpenAI employee account. That employee's Codex account was linked to OpenAI's GitHub organization. Using the employee's Codex account, the researchers created a harmless pull request (PR) in OpenAI's internal monorepo.
That PR creation proved the authority to request repository changes. As a result, the attack went beyond the forum itself and extended to access to an OpenAI employee account and PR creation in OpenAI's internal monorepo, confirming the scope of the privileges involved.
The researchers said they did not view or download OpenAI's internal source code. They also said less than 72 hours elapsed from the initial vulnerability analysis to PR creation in OpenAI's internal monorepo. After confirming that the impact could extend to OpenAI's internal assets, the researchers halted further testing.
The researchers reported the issue through OpenAI's reporting channel via Bugcrowd. Hacktron AI said OpenAI notified them of a fix about 14 hours after the initial report. OpenAI said testing against the Discourse-hosted community.openai.com was explicitly excluded from the scope of its bug bounty program.
The bounty paid by OpenAI was USD 6,500. However, the payout was not for actions against Discourse. The reason for the bounty was an issue found on OpenAI's side, and Hacktron AI said the issue was an OpenAI SSO configuration vulnerability that allowed the forum breach to lead to access to ChatGPT and Codex accounts.
Discourse said it disclosed the vulnerability under the public name 'CVE-2026-32882' and assigned it a severity score of 8.8 out of 10. The severity rating is 'high.' According to Discourse's security advisory, if a manipulated HEIF file is uploaded, remote code execution is possible through a libheif vulnerability.
As a measure, Discourse replaced the relevant library. It also responded by running the image-processing program in a separate sandbox.
The significance of this research should not be taken to mean that a nonexpert can now hack a major tech company with a single line of instructions. Hacktron AI said the attack was not fully autonomous, and that direction from a skilled security researcher was important, as was the security researcher's judgment.
Instead, AI handled many time-consuming repetitive tasks such as vulnerability analysis, exploit writing, bug fixing, and adapting code to different targets, increasing the amount of work one expert could handle. As a result, even a small number of people could attempt attacks at a level previously associated with large organizations.
Hacktron AI analyzed that the barriers of time and expertise required to carry out attacks are falling. Work that previously required sufficient resources and several months can now be shortened to just days, and scarce offensive expertise is increasingly being converted into computing resources.
In that sense, Hacktron AI suggested that, beyond state-sponsored hacking groups and professional cybercrime organizations, smaller groups with some funding and security knowledge could attempt complex attacks. It also said that the ability to turn already existing vulnerabilities into real attacks may become democratized before the ability to discover new vulnerabilities does.
On that point, the task for defensive organizations is detection capability, it noted. In fact, the researchers sent thousands of manipulated images to several companies, and as a result triggered repeated crashes on some image-processing servers. In the researchers' view, the only company that detected this was Shopify.
Accordingly, companies are being urged to update relevant image-processing libraries to the latest version with security patches applied, block external HEIF and AVIF file handling in services where it is unnecessary, and isolate decoders in a separate sandbox when image processing is needed.
The article explains that even if an external forum or collaboration tool is compromised, there is a need to separate the privileges of external services and internal accounts so the breach does not spread into the internal development environment. It also notes the need to block access to the internal development environment through SSO accounts and to apply the principle of least privilege.
It goes on to propose monitoring for abnormal file uploads, repeated crashes in image-processing programs, and the work history of accounts used by AI agents. It also connects the incident to the view that AI has not completely replaced security experts, but has expanded the speed and scope of attacks that experts can carry out, and that AI could reduce attack development time and cost; if that acceleration outpaces companies' detection and patching speed, the gap itself could become a new security threat.
Source: IT DAILY · Lee Jae-young
Original: https://www.itdaily.kr/news/articleView.html?idxno=241739
References
This article was produced with the help of an automated content generation algorithm.
Source: IT DAILY
View originalThis article was summarized and organized by BizCrush based on the original article from IT DAILY. For exact quotations and full details, please refer to the original article.