Security researchers at Hacktron AI say they chained a heap-buffer overflow in HEIF image decoding with an OpenAI single sign-on misconfiguration, took over multiple OpenAI employees' ChatGPT and Codex sessions, and proved access by having an employee's connected Codex open a pull request in OpenAI's internal monorepo — without reading source. The team reports the discovery-to-repo proof timeline spanned less than 72 hours in late July 2026; OpenAI paid a $6,500 bounty for the OpenAI-side finding.
According to Hacktron's technical write-up, the researchers — Harsh Jaiswal, Mohan Pedhapati, and Rahul Maini — used Anthropic's Claude models (including Opus 5 after Opus 4.8 struggled with ASLR-enabled exploits) to help develop and port the image-decode exploit. Discourse, which hosts OpenAI's community forum, published advisory GHSA-vhm9-85gw-x335 for remote code execution via malformed HEIF uploads tied to upstream libheif (CVE-2026-32882) and told self-hosters to rebuild images.
The escalation path, as Hacktron frames it, was not "Discourse equals OpenAI." Compromising community.openai.com mattered because "Sign in with OpenAI" via auth.openai.com tied forum identity to broader OpenAI product sessions. Tokens belonging to active forum members — including employees — could reach ChatGPT, Codex, and connected services such as GitHub. Hacktron says it stopped further testing after the PoC pull request and coordinated disclosure with OpenAI (Bugcrowd) and Discourse (HackerOne).
OpenAI, in a comment preserved on Hacktron's page, clarified that testing against the Discourse-hosted forum was explicitly out of bug-bounty scope; the $6,500 award recognizes the OpenAI-side SSO finding, not actions against Discourse. Hacktron says OpenAI confirmed a fix roughly 14 hours after the initial Bugcrowd submission; Discourse replied over a weekend and had a fix the following Monday, later adding image-processing sandboxing as defense in depth.
Confirmed
- Hacktron AI (Jaiswal, Pedhapati, Maini) published a detailed July 25, 2026 disclosure timeline: Discourse RCE on community.openai.com, Bugcrowd report to OpenAI, employee ChatGPT/Codex session impact demonstrated via Codex-opened internal monorepo PR, then stop-testing.
- According to Hacktron, the forum path used a libheif heap overflow reached through Discourse's HEIC/HEIF upload → ImageMagick conversion pipeline on a Debian-based Discourse image missing a security-relevant backport.
- Discourse advisory GHSA-vhm9-85gw-x335: RCE via malformed HEIF; cites upstream libheif CVE-2026-32882; patched Docker images and additional image-processing sandboxing noted.
- Hacktron attributes exploit development assistance to Claude (Opus 4.8 then Opus 5) and states the wider "HEIF Heist" campaign cost under $3,000 in model tokens across about two months of multi-vendor research.
- OpenAI paid $6,500; OpenAI's quoted scope note: award is for the OpenAI-side finding, not Discourse-host testing (out of program scope). Hacktron: OpenAI-side fix ~14 hours after initial submission.
Unknown
- Independent public confirmation of every internal impact detail (exact token lifetimes, how many employee sessions were reachable, monorepo contents) beyond Hacktron's account and secondary press summaries.
- Whether similar SSO token blast radius still exists on other OpenAI first-party or third-party "Sign in with OpenAI" surfaces after the reported remediation.
- How much of the exploit chain was model-autonomous versus human-guided — Hacktron describes skilled guidance as still important, with models compressing time-to-exploit.
- Full text of the first major press exclusive is paywalled; Brocker grounded Confirmed facts in Hacktron's write-up and the Discourse advisory, not unquoted secondary summaries.
Our take
The durable story is identity blast radius, not a cartoon AI-hacked-OpenAI headline. A forum RCE became enterprise-relevant because SSO tokens bridged community login into ChatGPT, Codex, and GitHub connectors. That is a classic trust-boundary failure: human approval and session isolation matter as much as patching decoders. Claude accelerating exploit porting under ASLR shows how fast "known bad library + missing backport" becomes operational for a small team — defenders should assume HEIF/AVIF upload paths and sticky SSO cookies are now economically interesting to attackers who rent frontier models, not only to nation-state shops.
