Hacktron AI(@HacktronAI):On July 25, our team hacked OpenAI. It took us less than 72 hours. Two vulnerabilities chained together gave us access to ChatGPT and Codex accounts belonging to OpenAI employees. We demonstrated the impact with a harmless PR in OpenAI’s internal monorepo. The full chain: HEIF upload → libheif heap overflow → RCE → OpenAI SSO flaw → ChatGPT/Codex takeover → connected GitHub → internal PR. OpenAI fixed the SSO issue roughly 14 hours after our report. Research by @rootxharsh, @S1r1u5_ and @iamnoooob. Full technical write-up:

Hacktron AI

@HacktronAI

Hacktron is an autonomous vulnerability hunter for ambitious engineering teams. Built by world-class security researchers. Powered by one principle: PoC || GTFO

加入 April 2025

12 正在關注 9K 粉絲

Hacktron AI@HacktronAI

2026.09.18 03:55

On July 25, our team hacked OpenAI. It took us less than 72 hours. Two vulnerabilities chained together gave us access to ChatGPT and Codex accounts belonging to OpenAI employees. We demonstrated the impact with a harmless PR in OpenAI’s internal monorepo. The full chain: HEIF upload → libheif heap overflow → RCE → OpenAI SSO flaw → ChatGPT/Codex takeover → connected GitHub → internal PR. OpenAI fixed the SSO issue roughly 14 hours after our report. Research by @rootxharsh, @S1r1u5_ and @iamnoooob. Full technical write-up: