Connecting an AI assistant to your company’s tools makes it more useful. It also raises the stakes of someone else getting into that account.
Security researchers at Hacktron say they demonstrated exactly that at OpenAI.
In their published investigation, the team describes chaining a forum vulnerability with an OpenAI single sign-on flaw on July 25. They compromised employee ChatGPT accounts and used one employee’s connected Codex to open a proof-of-concept pull request in OpenAI’s internal repository.
The researchers say they stopped without reading internal code. Access to other connected services remained a potential consequence, rather than a demonstrated breach of every integration.
That distinction matters. So does the route they took: a public-facing community service became a path toward sensitive corporate work.
For businesses connecting AI to their own systems, that is a security question worth bringing to the next deployment meeting.
It started with an image upload
Discourse, the software behind OpenAI’s community forum, has independently documented the underlying image-processing vulnerability. A flaw in libheif, a library used to process images, allowed an uploaded file to trigger remote code execution.
In plain English: processing the wrong image could let an attacker run commands on the server.
Discourse’s advisory lists patched releases and a rebuilt Docker image containing the corrected library. It also describes additional sandboxing for image processing, which limits what that component can reach if another vulnerability appears.
There is a useful lesson tucked inside that fix. Features as ordinary as image uploads deserve isolation from the rest of an application. A forum needs to display a picture. Its image processor should have very little authority beyond that job.
AI helped shorten the work
Hacktron credits Claude Opus 5 with overcoming an exploit-development hurdle that Opus 4.8 had struggled with. The team reports less than 72 hours from initial discovery to repository access, with skilled humans still guiding the work.
Its reported token spending of under $3,000 covered a broader, two-month research campaign—not this incident alone. Hacktron says OpenAI fixed its issue the day it was reported and later awarded $6,500 for the OpenAI-side finding; forum testing was excluded from that bounty’s scope. These details come from the researchers’ account.
OpenAI also told The Guardian that it had addressed the exploited vulnerabilities.
The implication is uncomfortable: security teams have to plan for technically demanding attacks becoming easier to carry out. Difficulty has always been an unreliable defense. As AI reduces the work involved, it becomes even less dependable.
The maintenance problem underneath the AI story
There is another participant in this story who deserves attention: the person maintaining the software everybody depends on.
On the libheif project page, maintainer Dirk Farin describes maintenance as almost entirely unfunded. Between January and August 2026, the project published 37 security advisories and made six releases primarily to deliver security fixes. He says the work of reproducing, fixing, testing, and releasing those changes happens during evenings and weekends.
That is a striking mismatch. Automated tools can help organizations find vulnerabilities faster, while the responsibility for resolving them still lands on a small maintenance operation.
Buying better security tools addresses only part of that problem. Companies also need a reliable process for getting fixes into the software they actually run—and a reason to help fund the dependencies that keep those products working.
Your assistant’s permissions are part of your security perimeter
The enterprise appeal of connected AI is straightforward. An assistant that can reach the right files and tools can finish more of a task.
Each connection also deserves a concrete explanation: what can this account read, what can it change, and how quickly can access be revoked?
The Neuron’s conversation with Alice CEO Noam Schwartz explored this broader problem. Once companies combine a model with tools, credentials, memory, and business data, they take responsibility for securing that combined system.
For buyers, that should change the product demonstration. Alongside the impressive completed task, ask to see restricted access, approval requirements, and a useful activity log. Ask what happens when an employee’s account is compromised. Ask whether sensitive actions remain protected after that first failure.
For vendors, those controls are an opportunity to earn trust. Clear permissions and effective isolation make it easier for customers to connect valuable systems with confidence.
The next time an AI product offers to connect everything, the follow-up should be specific: show us exactly what that connection authorizes.
Related reading
- AI Agents Are Finding Ways Around Restrictions. Who Controls Their Next Move? — How permissions and approval controls determine what agents can actually do.
- AI Security CEO Warning: The Risk From Agents Is “Almost Infinite” — Our conversation with Alice’s Noam Schwartz on securing models alongside their tools, credentials, and data.
- Microsoft Wants to Turn Cybersecurity Into a Continuous AI Defense Loop — A look at how defenders are combining AI automation with human control over consequential actions.
