How they hacked OpenAI -- In plain English: Bug #1: - They uploaded a booby-trapped image to OpenAI's public help forum. - The image was crafted so that the forum image reader would miscalculate where one image layer was relative to another layer, and as a result write data outside of where the data is meant to be allotted. By carefully managing this, they could get the image reader to write specific data to a specific place. This let them overwrite the program's own instructions. - As a…

S1r1u5_@S1r1u5_21h ago

At a high level, this was the full exploit chain. 1. HEIC/HEIF upload 2. ImageMagick decoding 3. Heap overflow on libheif 4. RCE on https://t.co/gxAS3NLZ3q 5. Critical OpenAI SSO flaw 6. ChatGPT/Codex takeover 7. Connected GitHub access 8. Internal repo PR #1186742