# AI-Assisted Hack Exposes Critical SSO Vulnerability in OpenAI Systems Researchers hijacked staff accounts via forum exploit, revealing systemic security flaws - **Source:** [Security Affairs](https://brifing.si/source/e6c4f5ec-3e1b-4152-a932-056243bd56eb) - **Published:** 2026-09-19 - **Topic:** [Data & AI](https://brifing.si/c/data-ai) - **Original article:** - **On Brifing:** https://brifing.si/s/860d523d-4ff4-4273-9a7f-0b2fdb6f1a2f ## Forum flaw enabled account takeover Researchers exploited a vulnerability in OpenAI's Discourse forum to hijack staff accounts. The attack leveraged a heap buffer overflow in libheif during HEIC/HEIF image processing. Unlike phishing attacks, this method required no password leaks. By abusing the 'Sign in with OpenAI' SSO, attackers gained access to connected services including GitHub, Slack, and email. The entire compromise from discovery to repository access took under 72 hours. ## AI accelerated exploit development Claude Opus 5 built a working exploit against a local Mac in just three hours, a process that normally takes weeks. The AI model succeeded where Opus 4.8 failed, especially bypassing ASLR protections. Researchers spent only $3,000 in AI tokens for the entire two-month HEIF Heist project targeting multiple companies. Each new target adaptation took just 1-2 days, demonstrating AI's growing capability in vulnerability research. ## SSO architecture amplified risk The critical vulnerability wasn't in Discourse itself but in OpenAI's SSO implementation. Any compromised service using OpenAI SSO could provide equivalent access to sensitive systems. Researchers proved this by making a harmless pull request via a hijacked Codex account. OpenAI's $6,500 bounty specifically excluded the Discourse-hosted component, highlighting the SSO as the actual security boundary. ## Industry-wide implications The libheif vulnerability affects any service processing HEIC/HEIF/AVIF images. Hacktron demonstrated this by targeting Slack, Meta, and GitHub Enterprise during their HEIF Heist project. Discourse patched the issue within days and added sandboxing, but the core risk remains in shared identity architectures. Modern exploit economics have shifted - sophisticated attacks now require compute resources rather than rare expertise. ## Attack methodology details After local code execution confirmation at 6 am, researchers gained root access by 10 am using a disguised cloud instance. They carefully avoided reading source code or merging changes during the OpenAI test. The exploit was ported to match Discourse's x86-64 server setup running jemalloc. Opus 5 refused to attack recognized live systems, requiring CTF-style deception. ## Response and remediation OpenAI implemented fixes within 14 hours of reporting, while Discourse had patches ready by the following Monday. The rapid response contrasts with typical corporate timelines for similar vulnerabilities. However, the report emphasizes that dependency scans won't catch identity architecture flaws - these require explicit threat modeling of SSO implementations. ## Changing economics of hacking Memory corruption exploits that once required expensive expertise can now be developed cheaply using AI. The $3,000 total project cost demonstrates this shift. Report concludes that security assumptions must account for modern attacker capabilities rather than outdated notions about attack sophistication requirements. ## Security recommendations Organizations must verify actual libheif versions in use, not just package manifests. Any low-trust surface sharing login with core infrastructure becomes an attack vector regardless of the software's security record. The report urges re-evaluating threat models to consider AI-powered exploitation capabilities and the real cost barriers to sophisticated attacks today. ## Sources covering this story - https://securityaffairs.com/199378/ai/ai-helps-hackers-hijack-openai-staff-accounts-through-a-forum.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._