How OpenAI got hacked with an image
Source: YouTube · LiveOverflow · published Sep 18, 2026 · 18:12
[BLUF] Security researchers Harsh and Mohan utilized an outdated image processing library (libheif) within OpenAI's community forum to achieve remote code execution, which they escalated to compromise an employee's account and submit a pull request to OpenAI's internal repository, demonstrating that AI has drastically lowered the barrier for complex exploitation 9:43.
Key Takeaways:
• The exploit originated from a heap buffer overflow in the older libheif library used by Discourse, which was triggered by uploading a malicious HEIF image 5:44.
• AI agents played a crucial role in both identifying the suspicious code commit that accidentally fixed the bug and in crafting the complex exploit code, highlighting a shift in threat models where AI automates laborious exploitation steps 6:08.
• After gaining RCE on the community forum, the researchers used OAuth vulnerabilities to take over an employee's ChatGPT account, granting them access to internal tools like Slack and code repositories 9:54.
• The researchers demonstrated the severity of the breach by prompting an AI agent to open a pull request in OpenAI's internal repo, though they refrained from viewing private data to remain ethical 10:31.
• Despite the critical nature of the chain, OpenAI paid only $6,500 because the initial Discourse vulnerability was technically out of scope, despite the clear path to internal assets 12:42.
The incident underscores that "security through complexity" is no longer a viable defense against attackers leveraging AI to automate and accelerate exploit development. As threat models evolve, organizations must recognize that AI-enabled hackers can now perform tasks that previously required rare, high-level expertise.
Sources:
- 2:41 Discussion on Harsh's experience breaking OAuth and targeting OpenAI apps.
- 5:44 Explanation of the libheif vulnerability and how the agent identified it.
- 6:08 Details on the specific code commit that accidentally fixed the bug.
- 9:43 Confirmation of successful RCE on the OpenAI Community Forum.
- 9:54 Description of escalating access to an employee's account.
- 10:31 The decision to use AI to open a PR rather than steal data.
- 12:42 The outcome of the bug bounty disclosure and payment.
- 16:49 Analysis of how AI has shifted the hacker threat model.
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
This video was recorded in late July when Harsh and Mohan...
Stop, stop, stop! Sorry, we didn't even start the video yet
and I'm already interrupting from the future. I had this really cool intro where
I just show you the recording of how Harsh and S1r1us from
Hacktron created a pull request in OpenAI's main internal repository
to leave a message proof that they hacked it. Unfortunately, OpenAI was too scared
and requested that we don't show it. So instead you see this lame but pretty
accurate reenactment of this moment. Yes, two guys who are,
according to the Rand Institute, a silly OC1 or OC2 level threat just hacked into
the heart of what is it now, $1 trillion company? Or thanks to AI, which is kind of ironic because
AI labs like OpenAI built hacking technology they cannot even …