Security startup Hacktron AI disclosed this week that on July 25, 2026 it chained a vulnerable image decoder with a single sign-on misconfiguration to take over OpenAI employee ChatGPT and Codex accounts, then used one of those accounts to open a pull request inside OpenAI's internal monorepo. Both flaws have since been fixed, and OpenAI paid the team a $6,500 bounty.
Key takeaways
- The entry point was community.openai.com, a Discourse forum whose upload pipeline handed HEIC files to libheif 1.19.7, a build missing an upstream memory-safety fix that never received a CVE.
- A separate flaw in OpenAI's own SSO turned control of the forum into access to ChatGPT and Codex accounts, whose connectors could reach GitHub, Slack, Outlook, Gmail and Google Drive.
- Hacktron says Claude Opus 4.8 could not produce a reliable exploit with ASLR enabled, while Opus 5 managed it within hours of its July 24 release.
How a forum image upload reached OpenAI accounts
Discourse normally screens uploads with FastImage, but FastImage does not read HEIF, so the forum passed those files to ImageMagick, which decoded them with libheif. That detour exposed the parser directly to attacker-supplied images. According to Hacktron's disclosure writeup, the packaged version carried a heap buffer overflow that yielded out-of-bounds read and write primitives during decoding.
Code execution on the forum was only the foothold. OpenAI offers "Sign in with OpenAI" through auth.openai.com, and Hacktron said a misconfiguration in that OAuth-based identity flow let control of the forum become control of accounts that had authenticated through it. The researchers stressed that the escalation was not Discourse-specific: any first- or third-party service sitting behind the same SSO would have offered an equivalent path.
To prove the reach without reading proprietary code, the team prompted a compromised employee's Codex — an AI coding assistant wired into OpenAI's GitHub organization — to open a benign pull request in the openai/openai repository, then stopped testing. The scope of exposure varied by account, since it depended on which connectors each user had enabled.
What changed between Opus 4.8 and Opus 5
The exploit-development timeline is the part security teams are likely to reread. Hacktron said Anthropic's Opus 4.8 spotted that security fixes had not been back-ported into the packaged libheif, but repeatedly failed to make an exploit reliable once address-space layout randomization was enabled. Anthropic shipped Opus 5 on the evening of July 24. A fresh session produced a working ARM64 exploit in roughly three hours, and the port to the x86-64 and jemalloc configuration Discourse uses followed.
Local code execution through an image upload was confirmed by 6 a.m. on July 25, and by 10 a.m. an agent running against the team's own Discourse Cloud instance had reproduced it remotely. The wider campaign behind the incident — Hacktron calls it HEIF Heist, and names Slack, Meta, Zoom, Shopify and GitHub Enterprise among the targets — ran two months across three researchers and cost under $3,000 in model tokens.
The capability claim is worth weighing with the source in mind, since Hacktron sells AI-driven offensive security and has an interest in the conclusion. What tempers that is the paper trail: the dates, the advisory and the patched package versions are all checkable, and Discourse independently confirmed the underlying decoder bug rather than taking the researchers' word for it.
Why one image library sat under so much software
The upstream commit that corrected the memory-safety bug was not labelled a security fix and carried no CVE, so Debian 12 and 13 kept shipping vulnerable packages long after the code itself was repaired; Debian published its update for Debian 13 on August 8, 2026. Discourse moved quickly once notified, replying over a weekend, shipping a fix the following Monday, adding sandboxing around ImageMagick as defense in depth and publishing advisory GHSA-vhm9-85gw-x335, which VentureBeat reports carries a CVSS score of 8.8.
The size of the payout says something too. OpenAI settled at $6,500 and noted that testing the Discourse-hosted forum was outside its program, so the award covered the identity flaw rather than the chain that made it reachable. Bounty scopes are drawn around assets a company owns; attack paths are not. A community forum that nobody files under production infrastructure is exactly the kind of asset that ends up trusted by a production identity provider.
What this means for teams running AI agents
The pattern echoes an earlier case in which an AI pentester surfaced a three-year-old admin token in 25 minutes. The novelty is not the bug class but the price of the expertise. Hacktron's own framing is that security through complexity is eroding: turning a known memory-corruption bug into a working exploit used to demand rare skill and weeks of effort, and is now largely a compute purchase.
The remedies are unglamorous. Patch libheif and libde265 to current security releases, disable untrusted HEIF and AVIF decoding where it is not needed, isolate image processing inside ephemeral sandboxes, and treat an AI agent's OAuth connectors as privileged credentials rather than conveniences. One detail deserves its own line: across every company Hacktron tested, it says only Shopify appeared to notice the activity.
FAQ
Are the OpenAI and Discourse vulnerabilities still exploitable?
No. Discourse patched the image-processing flaw and published a security advisory in late July, and OpenAI confirmed a fix for the SSO issue roughly 14 hours after the Bugcrowd report. Operators who self-host Discourse still need to rebuild their containers to pick up a patched libheif.
Did the researchers read OpenAI's source code?
Hacktron says it did not. It used the compromised employee's Codex access to open a harmless pull request as proof of reach, then halted all further testing. The Wall Street Journal separately reported the access to an OpenAI employee account.
Did Claude hack OpenAI on its own?
No. Hacktron describes skilled human direction throughout, with the models handling exploit development, privilege escalation and adaptation to each new target. The team also noted that the model declined to build exploits aimed at systems it did not recognise as the researchers' own.
