An image upload to OpenAI’s community forum was enough to reach OpenAI’s internal code. In a write-up published on September 13, 2026, the offensive-security firm Hacktron AI describes how it chained a memory-corruption bug in the libheif image decoder with a single sign-on (SSO) misconfiguration at OpenAI. The result: remote code execution on community.openai.com, takeover of ChatGPT and Codex accounts belonging to forum users, and a proof-of-concept pull request in OpenAI’s internal monorepo. The research was reported through OpenAI’s bug bounty program on Bugcrowd, and OpenAI confirmed a fix about 14 hours after the report.
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Key facts
- Entry point: a heap buffer overflow in libheif, reached through Discourse’s image-upload pipeline (HEIC/HEIF files are handed to ImageMagick, which calls libheif).
- Root cause of the decoder bug: an upstream fix that was never labeled as a security fix and received no CVE, so Debian 12 and 13 did not backport it in time. Discourse’s Docker image shipped libheif 1.19.7.
- Escalation: an OpenAI SSO flaw (“Sign in with OpenAI” via auth.openai.com) turned the forum compromise into access to ChatGPT and Codex accounts of active forum members, without any interaction from them.
- Impact shown: through an employee’s Codex account connected to OpenAI’s GitHub organization, the researchers had Codex open a harmless PR in the internal monorepo and then stopped testing.
- Time to impact: under 72 hours from starting the review to repository access.
- Fixes: OpenAI fixed its side on July 25; Discourse had a patch by July 27, added image-processing sandboxing and published advisory GHSA-vhm9-85gw-x335 on July 28.
- Bounty: $6,500. OpenAI noted that testing against the Discourse-hosted forum was out of scope; the award covers the OpenAI-side finding only.
cybersecurity vulnerability scanner
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
How the chain worked
Hacktron’s team (Harsh Jaiswal, Mohan Pedhapati and Rahul Maini) says it deliberately went after a dependency, because Discourse itself is a hard target. Discourse normally checks images with FastImage, which does not support HEIF. HEIC and HEIF uploads therefore took a different path: they were converted with ImageMagick’s magick command, which exposed the libheif parser directly to attacker-controlled files.
The vulnerable code had already been changed upstream the year before, but the change was not documented as a security fix. According to the write-up, that is a likely reason distributions missed it: Debian 12 still carried libheif 1.19.7 and Debian 13 carried 1.19.8. Debian released a security update for Debian 13 on August 8, 2026 (DSA-6417-1).
The decoder bug gave the researchers code execution on the forum server. The more serious part is the second link. Hacktron stresses that the escalation is not specific to Discourse: it is an OpenAI SSO issue. In their words, if any first-party or third-party service using OpenAI’s SSO had been compromised, it would have led to the same access. Because users connect services such as GitHub, Slack and email to ChatGPT and Codex, the potential reach was large.
secure identity management system
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Disclosure timeline (UTC, July 25, 2026 unless noted)
- 05:00–06:00: code execution and admin access on the forum.
- 08:00–10:00: report submitted through OpenAI’s Bugcrowd program.
- 13:30–15:30: employee account access and proof-of-concept PR; testing stopped around 15:30.
- 22:49: OpenAI confirms the fix.
- July 26–28: Discourse responds, ships a fix with sandboxing and publishes its advisory.
- September 1: OpenAI awards the $6,500 bounty and marks the report resolved.
heap buffer overflow detection tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Why defenders should care beyond OpenAI
Hacktron has since widened the work into a project it calls “HEIF Heist,” tracing libheif through Slack, Meta, GitHub Enterprise, Ruby on Rails and Node.js frameworks such as Next.js, Astro and Gatsby. The firm says it is not aware of any target that detected the activity except Shopify, even though thousands of images were sent and image processors crashed repeatedly.
The practical takeaway is about image pipelines. Any application that accepts user-supplied .heic, .heif or .avif files and decodes them server-side is in scope, and the vulnerability spans several libheif release families (1.19.x, 1.20.x, 1.22.x and 1.23.x).
As an affiliate, we earn on qualifying purchases.
What to do now
- Self-hosted Discourse: rebuild the installation (
git pull, then./launcher rebuild appin /var/discourse). A web-interface update alone may not replace the vulnerable library. Discourse-hosted customers are already patched. - Update libheif and libde265 through your distribution’s security channel or upstream. As of September 14, 2026, the latest upstream security release is libheif v1.23.4. Distribution packages may carry backported fixes under older version numbers, so check the advisory rather than the version string.
- Reduce the attack surface: disable HEIF/AVIF decoding where you do not need it, restrict formats in ImageMagick’s security policy, and run image processing in hardened, short-lived sandboxes.
- Review SSO trust: treat every app that signs in through your identity provider as part of the blast radius. A compromised low-value app should not be able to mint access to high-value accounts.
The AI angle
Hacktron used Anthropic’s Claude models throughout. Opus 4.8 found the missing backport and built a working exploit with ASLR disabled, but several sessions failed to make it reliable with ASLR enabled. After Claude Opus 5 was released on the evening of July 24, a new session produced a working exploit within hours, and an autonomous agent loop achieved code execution against a Discourse Cloud test instance the team controlled. The firm reports that the whole two-month HEIF Heist project cost less than $3,000 in tokens. It adds that this was not fully autonomous hacking and that skilled human guidance remained important.
The firm’s conclusion for security teams: complexity used to make turning a bug into a reliable exploit slow and expensive, and AI is removing that cushion. Threat models should assume that far more attackers can now operationalize known memory-corruption bugs.
Source: Hacktron AI, “Hacking OpenAI” (September 13, 2026). Discourse advisory: GHSA-vhm9-85gw-x335.
Fall Picks
fall essentials
As an affiliate, we earn on qualifying purchases.
