Skip to content

s1r1us

@S1r1u5_ · view on X ↗

founder @ElectrovoltSec, @HacktronAI

20.8K followers
1 thread on ThreadOut

Unrolled threads

Every thread by s1r1us that readers unrolled on ThreadOut.

On July 25, we hacked OpenAI. Two bugs let us take over ChatGPT/Codex accounts of OpenAI employees (+some unaffiliated users) and reach connected services: Outlook, Slack, GitHub, etc. We proved it...

SummaryA security research team exploited two bugs to compromise OpenAI systems in under 72 hours: a heap overflow in the libheif image library and a critical SSO vulnerability that allowed them to take over employee ChatGPT accounts and access connected services like GitHub, Slack, and Outlook. They demonstrated the breach by creating a harmless PR in OpenAI's internal repository, and OpenAI patched the SSO flaw within 14 hours and awarded them $6,500.Sep 18, 202614 tweets♥ 8.1K