OpenAI JUST got HACKED...

Video authored by the channel shown, not by IANIA; all rights belong to the creator. Transcript and summary generated automatically; the original-language content is preserved.

Original language: English

Original video: OpenAI JUST got HACKED… · Channel: Wes Roth · 14:36 · Watch on YouTube

Topics: AI agents, Cybersecurity and software security, AI models, AI safety

Summary

The video describes Hacktron’s reported discovery of vulnerabilities that could let attackers compromise OpenAI accounts and reach its internal code repository through a chain involving Discourse, single sign-on, and image-processing software. The host says Anthropic’s Claude models helped identify and exploit parts of the vulnerability chain, with a newer model succeeding where an earlier one had not. Hacktron reportedly disclosed the issues to OpenAI and tested related attack paths at other companies, with Shopify named as one that detected activity. The video highlights how AI agents can speed up vulnerability research and increase the scale of cyberattacks, while emphasizing that human guidance was still involved.

Key points

Hacktron, a cybersecurity company, reported that weaknesses in OpenAI’s forum and identity flow could expose employee ChatGPT and Codex accounts.
The reported route involved OpenAI’s use of Discourse, single sign-on, and an image-processing path that could expose a parser to attacker-controlled files.
The host describes the attack as a chain of vulnerabilities across multiple systems rather than a single flaw.
According to the video, Claude Opus 4.8 helped find a vulnerability, while Opus 5 was able to use it to achieve remote code execution.
Hacktron reportedly demonstrated access involving an employee account connected to OpenAI’s GitHub repository and reported its findings to OpenAI.
The video says the research took more than two months overall and cost less than $3,000 in tokens, while the exploit adaptation for other companies took one or two days.
Shopify is named as a company that detected activity; the video says Hacktron did not identify the other companies it tested.
The host stresses that AI-assisted hacking was not fully autonomous in this case, but that one person could oversee multiple agents and increase the amount of work done.
The video closes by framing disclosure and patching as a race to secure widely used software before vulnerabilities are exploited maliciously.

Chapters

Start	Chapter	Summary
00:00	The reported OpenAI hack and the XKCD connection	The host introduces Hacktron’s reported access to OpenAI accounts and its internal repository, then connects the incident to XKCD’s warnings about fragile software dependencies.
03:43	How the vulnerability chain worked	The video outlines how weaknesses involving Discourse, single sign-on, and image processing could combine to create a path into OpenAI services.
06:01	Claude-assisted vulnerability research	The host explains how Claude models helped investigate the flaws, including a reported heap buffer overflow and the later use of the exploit for remote code execution.
09:14	Access demonstration and attacks on other companies	Hacktron reportedly demonstrated access through an employee account connected to GitHub, disclosed the findings, and tested adapted attack paths elsewhere.
12:31	The wider implications of AI-assisted hacking	The host discusses the risks of scaling cyberattacks with AI agents and concludes with the importance of finding and patching vulnerabilities.

Quotes

They used Claude. — 00:00

It was ImageMagick, as was foretold. — 01:07

Opus 5 could do it. — 08:44

This is not completely autonomous, not yet at least. — 11:59

Concepts and entities

Hacktron, OpenAI, Anthropic, Claude, Opus 4.8, Opus 5, ImageMagick, Discourse, Shopify, XKCD

Full transcript (original language)

00:00 OpenAI just got hacked, or at least we’re just beginning to find out about it. It took the hacking group less than 72 hours to hack OpenAI. They got access to employees’ ChatGPT and Codex accounts. They even got access to OpenAI’s internal mono repo where all the data, all the code is stored. How did they do it? They used Claude. Claude, Anthropic’s model. So, they took Anthropic’s model and they hacked OpenAI with it. Also, there’s this comic book that’s been online for since the dawn of the internet, I think, called XKCD that

00:35 just repeatedly almost predicts all these AI hacking attempts, like how it’s going to do it. You might have seen this image before. All modern digital infrastructure is like relying on this tiny little project that some random person in Nebraska has been mindlessly maintaining since 2003. And if you hover over the image, it says [clears throat] that someday ImageMagick will finally break for good and we’ll have a long period of scrambling as we try to reassemble civilization from the rubble. Can you guess what part the AI used to

01:07 accomplish this whole thing? It was ImageMagick, as was foretold. The whole thing about Bobby Tables that this comic book wrote about, that was used in that whole Hugging Face hack incident. Like, I think at this point the AI agents are just like browsing through this looking for ideas. So, what’s crazy is if the hackers got to OpenAI’s mono repo, it’s basically this one big repository where they keep all the code, and we don’t know what’s in there necessarily. Well, I guess the hackers do. But, it could be ChatGPT back-end code. It could be a lot

01:39 of like the training materials, the training infrastructure that they used to train the models, research tools, safety systems, probably tons of their internal infrastructure, like a bunch of stuff that’s kind of important. Like, the models themselves are not on there, but I would assume that a lot of the other stuff is. So, some good news first, OpenAI got hacked by the good guys. They got hacked by Hacktron. So, Hacktron is a San Francisco-based, you

02:10 know, their cybersecurity experts, researchers, but mainly a cybersecurity company. And they’re really going hard on this autonomous AI agents, you know, hacking, penetration testing, beefing up security, eliminating vulnerabilities, you know, cybersecurity with AI agents. So, first and foremost, as they say here, until 2 months ago, any user or OpenAI employee logging into OpenAI’s own health forum could have had their ChatGPT and Codex accounts taken over.

02:41 So, a lot of this had to do with that single sign-on SSO, right? You know how you sometimes can get a link, you click, you sign on, or with Google, for example, if you use Google accounts, you can use that to log into a lot of different stuff as kind of from your Google account. So, there’s no password involved, you’re logging into Google, and through Google, you log into that thing. OpenAI even coughed up a $6,500 bounty for their efforts. By the way, the fact that this was, you know, until 2 months ago, people could have hacked

03:12 and then stolen information, this was just open. That’s an important point to understand because a lot of companies are realizing that now with AI, a lot of the stuff that we thought secure, we realize the it’s really, really not. It’s like if you build a house, and you could look around, and you’re like, “I don’t see any holes in the walls or in the ceiling.” Like, we we sealed this thing pretty tight. Then AI takes a look at it, crawls all over it, and it’s like, “Here’s a billion holes that I found.” And they they point at one, we’re like, “Oh, yeah, I get it.” By the way, they’re saying they’re not stopping

03:43 at OpenAI. Apparently, there’s this high heist. I’m not going to go too deep into the technical cyber details, whatever. Just wait for the Fire Ship video, I guess. But, the point you understand is that there’s this one little library or one little set of tools that’s a lot of the stuff that we use kind of re-re-relies upon. It depends on it. So, Slack, Meta, GitHub Enterprise, Ruby on Rails, Node.js. As they say here, a surprising amount of widely used software depends on this one image processing library. And exhibit A

04:19 is the XKCD comic. So, they noticed that OpenAI uses Discourse for their forum. So, it’s another software that OpenAI has used for the help forums where developers could go and chat and talk and help each other and discuss things. And they realized that this forum, it could compromise a lot more than the forum. So, if they’re able to crack that Discourse software, they could potentially create a path into broader OpenAI services through this identity flow. But, the Discourse app is not an easy target. And this is going to be one

04:53 of the things that we’ve seen with the the Hugging Face incident and we’re going to be seeing here and probably a lot more that a lot of these hacks happen because these AI models, they’re chaining zero-day exploits or using an exploit chain, whatever you call it. Basically, they’re finding multiple errors, multiple holes, and they’re kind of lining them all up and they’re able to shoot through to to wherever it is they’re going. So, it’s not like it found one thing and through that one thing it was able to just get into the OpenAI servers. It found vulnerabilities from a lot of different things that a

05:27 lot of us rely on, that OpenAI relies on. And was able to use the flaws in all those systems to get into OpenAI. So, they found that Discourse uses one sort of image processing software. So, if you’re uploading an image from your phone or a screenshot or whatever, usually it’s processed through fast image. You don’t be familiar with exactly what this is. Basically, for image processing, it used one piece of software, but for some small percentages of images that needed this hyphen thing, it would pass those to ImageMagick. Again, ImageMagick is is is is this here. And they realized that they were

06:01 able to do this to expose the underlying parser directly to attack the controlled files. This basically means that this little workaround allowed the server to basically read and process files uploaded by anyone. So, here’s where it gets a lot more interesting, and here’s where AI is coming in. So, they started with Opus 4.8 working on this thing to see how they can hack it, if they can find some vulnerability. So, this was shortly before Opus 5 was released. So, they’re using the best available model to to find these vulnerabilities, but

06:34 Opus 4.8, well, it found some security issues that should have been patched, but weren’t. Basically, you have this whole database, the CVE, common vulnerabilities and exposure. So, this keeps track of all of these sort of these little hacks and vulnerabilities. So, as soon as somebody discovers it, they log it, it gets reported, and then it gets logged and put into this database, this catalog of known hacks. And even though some of these uh software companies, they knew about the hack, it was reported to them most

07:05 likely, they did patch some of their stuff, but they did not document it as a security fix, and it wasn’t kind of put into that catalog of hacks, the big book of hacks, if you will. So, that likely allowed a lot of different softwares to still have that vulnerability, even though it should have been patched across the entire ecosystem. So, the point is, they figured out on July 25th, so one day, right? They were able to figure out with Opus 4.8 this magic code

07:37 execution exploit. And specifically, it was a heap buffer overflow. So, you can think of that as like, let’s say the waiter comes up and he starts taking your order. He’s got his little notepad where he wrote down everyone’s orders and you say, “Oh, I have my order here in this little sticky note. Here’s the sticky note.” Or whatever, like a little folded up crumpled piece of paper. You tell him, “Just go ahead and unfold it and that will have my order.” So, the waiter starts unfolding it, but that note is just getting bigger and bigger and bigger bigger than his little notepad. So, basically that’s what a

08:07 buffer overflow is is is writing so much that it overflows the memory. So, you can imagine that little piece of paper, that note just taking over the entire notepad. I think that analogy works. I’m going to stick with it. So, the point is you’re able to write whatever you want on the waiter’s notepad. You’re able to like take it over and write over it. So, then Opus 5 gets released. Now, up to this point Opus 4.8, it couldn’t crack it. So, it did help find that vulnerability, but they couldn’t use that to crack open Discourse. That community forum software. But, Opus 5 gets released and guess what happens?

08:44 Opus 5 could do it. So, that was the evening of July 24th. By 6:00 a.m. on July 25th, they got everything going and by, you know, same day 10:00 a.m., they managed to do remote code execution on OpenAI’s instance. So, remote code execution basically taking control of it, being able to run whatever they want on OpenAI’s, you know, infrastructure on their servers. How did they trick Opus 5 into doing it? Well, they made it look like the capture the flag target. So,

09:14 they made it look like an exercise. And as soon as they confirmed it, they sent the report to OpenAI. Then they took over an OpenAI employee account who had their Codex connected to OpenAI’s GitHub. Right? So, this is an employee probably doing development on whatever OpenAI is working on on their infrastructure, their testing ChatGPT back end code, whatever. It’s connected to their repository, so they used the fact that employee was logged into the form to then see if they can start doing whatever they want to the code base that

09:49 OpenAI has. And so, basically just to prove that they can do it, they made some edits to something that was supposed to be for OpenAI employees only. OpenAI asked them not to reveal that screenshot, so this is kind of a mock-up, but it looks like, you know, they probably just replaced whatever it was or added a new file and said, “Hacktron AI team.” And now, of course, they reported to everyone that was involved, so that everybody could, you know, patch everything up. And they’re warning that this might be an issue, the single sign-on for for Codex that may connected to your GitHub, the fact that

10:21 it’s also something that you’re using to sign into other places that could have these vulnerabilities. They’re saying this could happen again. This wasn’t Discord specific, so they they went through one back door, but they’re saying there could be a lot more. And so, this hack took a few days for an agent and just a few hours of human time. The entire research project kind of a leading up to this, you know, it took more than 2 months and cost less than $3,000 in tokens in total. Then they took AI models and they told them to go after a whole bunch of other companies with that exploit. As they say

10:55 here, the AI started almost blind and adapted the exploit for each company within one or two days. So, once they had the exploit, they could just like replicate these Thomas AI agents and within a day or two, they were able to adapt it to go after, you know, they don’t say who. They only name one name. They said, “We are not aware of any company that detected the activity except Shopify. Even after thousands of images were sent and their image processes repeatedly crashed.” So, congratulations to Shopify, Tobi Lütke,

11:27 who is the founder and, you know, CEO at this point. He’s kind of into AI. He’s talking about quite a bit, so maybe they they they’re like getting ready for this. But the fact that you can have an army of autonomous agents just like hacking everybody, adapting these strategies to to hack different companies, and no one’s the wiser is kind of scary. And they’re saying when code execution landed inside of sandbox or restricted environment, the models also helped with privilege escalation, lateral movement, and bypassing existing defenses. So, the point is once the models were in, they could do a lot more

11:59 damage get a lot more control over whatever environment they were in, and humans had to guide them. This is not completely autonomous, not yet at least. But the point that they make is that with AI, the amount of damage that can be done greatly greatly increases. Strictly because one human can now oversee many different agents, kind of guide them along, but the amount of work getting done increased dramatically. So, the big point here, and this is the point that they’re making, is that what used to require like rare expertise, now

12:31 is really changing. AI is compressing how much work needs to be done to be able to do this effectively. So, kind of a wild tale, and also makes you think like what’s happening behind the scenes. Because I mean, this company is doing everything ethically and legally, this is their job. But of course, we also assume that there’s a lot of other people that are trying to do this but for nefarious ends. And they’re of course are not disclosing whatever they’re doing. And if they hack and are able to copy data over, no one might know. As a hacker on here said, most of the companies they went after they had

13:03 no idea, even though that image processing software kept rehashing. They’ve like purposely, it seemed like it triggered the alarm to go off repeatedly, and no one came to investigate what what that was. Which is kind of scary. They they don’t publish the names of the companies, but I’m curious kind of like what level? Because I mean, Shopify is one of them. But are we talking about companies like Shopify? Shopify, if you’re not aware, is a massively public traded company. It’s 165 billion. They do a big chunk of the

13:34 online e-commerce. A lot of the smaller shops that you see on the web that that aren’t part of like Amazon, and but a lot of them run on Shopify. So, if you’ve shopped online, you’ve likely used a Shopify or stores that run on Shopify without even knowing it. But, they’re saying that they were trying to hack companies of this level, and those companies had just no idea this was happening because that would be kind of scary. And looks like Hacktron and they’re not stopping, and they’re going to go after just everybody. Apparently,

14:05 the Hive thing is something that’s used for iPhone images or or Mac images that are produced. And they’re saying that they’ve uncovered attack paths that affect OpenAI, Slack, Meta, GitHub Enterprise, Rails, and Next.js, ImageMagick, and others. So, again, this is, I got to say, great news if you’re looking at it from a certain perspective cuz these people are working hard to find these backdoors, these vulnerabilities, and talk about them and publish them. So, hopefully, a lot of the software that we rely on, a lot of

14:36 the companies that we use, hopefully, they’ll be able to patch things up before things get kind of bad. But, that’s kind of the race that we’re in right now. And the fact that OpenAI got hacked, that is the most crazy thing to hear. That’s quite a headline because it’s one of the most important AI labs in the world. You don’t expect to see stuff like this happening. So, let me know what you thought about all of this. If you made this far, thank you so much for watching. My name is Wes Roth, and I’ll see you in the next one.