The people who broke into OpenAI's internal code spent less than 3,000 dollars doing it
OpenAI closed the hole fourteen hours after it was reported and paid a 6,500 dollar bounty. The figure that matters to anyone running a website is the cost: a two-month campaign that also probed Slack and Meta ran on under 3,000 dollars of tokens.
The version of this story that travelled was the catchy one: a team used one AI lab’s model to get inside another AI lab. That is documented and true. The detail worth your attention if you run a website sits halfway down the report instead.
Start with what happened. On 25 July, three researchers at a security startup called Hacktron AI reached OpenAI staff accounts and, through them, an internal code repository. To prove the access without reading anything sensitive, they had a harmless pull request opened in that repository and stopped there. From first discovery to that point took under 72 hours.
The way in was not OpenAI’s own product. It was the public community forum, built on third-party software, and an out-of-date image-decoding library inside it. Chained with a single sign-on misconfiguration on OpenAI’s side, a discussion board turned into a door to work accounts.
The part nobody headlined
The researchers reported the same day. OpenAI confirmed a fix about fourteen hours later and paid a 6,500 dollar bounty on 1 September. Discourse got the report on a Saturday, replied on Sunday, had a fix by Monday and published its security advisory on 28 July. As disclosure goes, this one worked.
Now the arithmetic. The full campaign ran two months, involved three people, and cost under 3,000 dollars in tokens. OpenAI was not the only target: the same team says it looked at Slack, Meta, GitHub Enterprise and widely used web frameworks including Next.js, Astro and Gatsby. Adapting to each new target typically took a day or two.
And by their account only one company spotted anything, even after thousands of images had been sent and image processors had crashed repeatedly.
Why the maths has changed
For years the real protection for an ordinary company was not the quality of its code. It was difficulty. A flaw could be public and still take weeks of specialist work to turn into a reliable attack, and those weeks were expensive, so the people who had them saved them for large targets.
This report shows that barrier giving way from the inside. One model failed to finish the job across several sessions, and the model released that same evening managed it in hours. We wrote earlier this year about how no AI lab passed its safety exam, and this is the same problem seen from the other side: capability is climbing faster than containment.
What to do if you run a site
The practical answer is duller than the headline. If your site accepts user-uploaded photos, and it accepts HEIC or HEIF files, which is what an iPhone produces by default, you are in the affected family. The fix is not a purchase. It is updating the image libraries through your distribution’s security channel and isolating image processing in a sandbox of its own. Debian shipped its update on 8 August, and as of 14 September the newest upstream security release was 1.23.4.
Dull Friday-afternoon work, in other words. Also, right now, cheaper than the alternative.
By Oliver Grant
Image: Hacktron AI
