OpenAI Signs Hacktron to Probe Third-Party Security Flaws

By Sophie Lindqvist

Hacktron said OpenAI paid it $6,500 for a single sign-on flaw that let the researchers take over ChatGPT and Codex accounts, and OpenAI has now signed the firm to hunt for more bugs. The deal gives Hacktron expanded access to OpenAI's frontier models through Daybreak Red and a role in choosing high-priority test areas.

Hacktron CEO Zayne Zhang said the company was “excited to deepen our partnership with OpenAI, combining our offensive security expertise with their frontier models to help secure OpenAI and the broader software ecosystem.” OpenAI wrote: “As AI agents connect services in new ways, that combination of skills becomes even more valuable.”

The stakes sit at a shared authentication boundary. Hacktron said services such as GitHub, Slack and email can connect to Codex and ChatGPT, so a weakness in OpenAI's sign-on can carry consequences beyond a single account.

What did Hacktron find in July?

Hacktron’s September write-up, “Hacking OpenAI,” said the researchers gained code execution on community.openai.com on July 25. The site runs on Discourse and offers a “Sign in with OpenAI” option, putting the forum and OpenAI's identity system on the same attack path.

The chain began with a heap overflow in the libheif image library, according to Hacktron. Discourse passed HEIC and HEIF uploads to ImageMagick, which exposed the parser to attacker-supplied files.

That foothold led to an SSO issue that let the team take over active forum members' ChatGPT and Codex accounts without any interaction from those users, Hacktron said. Hacktron then used an OpenAI employee's account, with Codex connected to the company's GitHub organization, to open a harmless pull request in the internal monorepo before stopping.

Hacktron said OpenAI confirmed a fix about 14 hours after the report and later paid the $6,500 bounty. In its comment on the report, which Hacktron reproduced, OpenAI said testing against the Discourse-hosted forum was excluded from the program; the award covered the OpenAI-side finding.

Hacktron said the escalation bug was not specific to Discourse. Any compromised first-party or third-party service using OpenAI's SSO would have led to the same access, according to the team. Because people connect GitHub, Slack and email to Codex and ChatGPT, the researchers said the theoretical reach was large.

The sequence matters: one uploaded image supplied code execution, and the SSO flaw turned that foothold into control of connected AI accounts. Hacktron did not need a separate ChatGPT or Codex exploit; the shared sign-on route linked the forum to services that users had connected.

How much time and compute did the exploit take?

Hacktron said the Discourse and OpenAI work took a few days for an agent and just a few hours of human time. That effort sat inside HEIF Heist, a wider project that also went after Slack, Meta and other targets.

The team said HEIF Heist took three researchers two months and less than $3,000 in tokens. It also compared how two Claude models handled the exploit under ASLR:

• Claude