A heap overflow and SSO misconfiguration to compromise OpenAI internal repos
8 hours ago
- Researchers chained two vulnerabilities to compromise multiple OpenAI employee ChatGPT accounts and access internal repositories in under 72 hours.
- The first vulnerability was a heap buffer overflow in libheif exploited via image uploads on OpenAI's Discourse forum, and the second was an SSO misconfiguration allowing account takeover.
- The team used AI models (Opus 4.8 and Opus 5) to develop and adapt exploits, with Opus 5 succeeding faster against ASLR-enabled environments.
- The attack demonstrates that AI reduces the expertise needed for exploit development, making previously expensive memory corruption attacks more feasible.
- OpenAI patched the issue within 14 hours and paid a $6,500 bounty, while Discourse fixed the libheif vulnerability and added sandboxing.
- The research cost less than $3,000 in tokens and involved three researchers over two months, targeting multiple companies beyond OpenAI.
- The HEIF Heist campaign highlights the need for updated threat models that account for AI-driven exploitation economics.
- Affected systems include any processing .heic/.heif/.avif images via libheif, with updates recommended to versions 1.23.4+ and defense-in-depth measures.