OpenAI hires the researchers who hijacked its own employee account
Hacktron gets deeper access to OpenAI frontier security models to probe third-party connections, after chaining a library bug with an over-permissioned token to reach internal GitHub repos.
OpenAI is formalising a partnership with security research firm Hacktron, giving its engineers a standing arrangement to jointly test how OpenAI’s systems connect to third-party services. As part of the deal, Hacktron gets wider access to OpenAI’s purpose-trained cybersecurity models through Daybreak Red, a platform OpenAI offers for vulnerability research and exploit validation.
OpenAI picked Hacktron because of what it had already found through the regular bug bounty programme: a heap overflow in libheif, the image library behind ImageMagick’s HEIF decoding, combined with an over-permissioned sign-in token on OpenAI’s Discourse-based community forum. Chaining the two let researchers take over an employee’s ChatGPT and Codex account and reach into OpenAI’s internal GitHub organisation, enough to open a proof-of-concept pull request. OpenAI paid a $6,500 bounty for the find and has since narrowed the token permissions.
Why it matters: the chain here is a familiar shape, an unpatched media-parsing bug plus a sign-in token scoped too broadly, and it is exactly the kind of weak point that multiplies as agents and third-party integrations get wired together. Worth checking what your own SSO tokens and image-upload paths can actually reach.
The caveat: the vulnerability itself was found and fixed months ago. What is new here is the partnership and Hacktron’s expanded model access, not a fresh bug.