Hacktron Breaches OpenAI: Insights from a AI‑Powered Attack Chain
openai
| Source: Mastodon | Original article
A recent Hacktron security research report details an AI‑assisted attack chain that compromised OpenAI systems.
Hacktron, a security‑research startup, disclosed an AI‑assisted breach of OpenAI’s internal systems that began with a seemingly innocuous image upload on the company’s public help forum. The team leveraged a flaw in the forum’s handling of HEIF images, combined it with weaknesses in OpenAI’s single‑sign‑on (SSO) flow and an ImageMagick processing bug, and then used Anthropic’s Claude Opus model to automate the exploitation steps. Within 72 hours the chain gave the researchers access to employee ChatGPT and Codex accounts, which they used to reach private GitHub repositories containing OpenAI’s code.
OpenAI patched the vulnerabilities after the report and paid Hacktron a $6,500 bounty, according to the company’s bug‑bounty program. The public disclosures do not confirm a wider production‑level compromise, but the incident illustrates how generative‑AI tools can accelerate multi‑stage attacks that would otherwise require deep manual effort.
The breach matters because it shows that AI models are no longer just targets of security research—they can become active participants in threat actors’ toolkits. By automating the discovery and chaining of disparate flaws, Claude helped the researchers move from a forum‑level issue to privileged internal access, exposing the risk of “AI‑assisted supply‑chain” attacks. For organizations that integrate ChatGPT, Codex or similar services with internal platforms such as GitHub or Slack, the incident underscores the need for rigorous validation of every external input and tighter isolation between public‑facing components and internal credentials.
Going forward, observers will watch OpenAI’s next steps: whether the company expands its bug‑bounty scope, introduces stricter image‑handling sanitisation, or rolls out broader AI‑usage policies. The broader security community is also likely to scrutinise other AI‑powered services for similar attack‑chain potential, prompting a wave of research into defensive measures against AI‑augmented exploits.
Sources
Back to AIPULSEN