Hacking OpenAI
A heap overflow and SSO misconfiguration to compromise OpenAI internal repositories
September 13, 2026 — 11 min read
On July 25, 2026, Hacktron researchers chained two critical vulnerabilities to compromise multiple OpenAI employees’ ChatGPT accounts. With these accounts, they could access internal OpenAI repositories and potentially many other connectors.
To prove access without learning sensitive information, they used an employee’s Codex to open PR #1186742 in OpenAI’s internal monorepo openai/openai.
Exploit chain
- libheif image decoder heap buffer overflow
- Debian missing security backport
- ImageMagick uses libheif via Discourse image uploads
- OpenAI forum community.openai.com RCE
- OpenAI SSO identity flaw
- ChatGPT / Codex account access
- GitHub connected integration → internal repos
Until two months ago, any user or OpenAI employee logging into OpenAI’s help forum could have had their ChatGPT and Codex accounts taken over.
Timeline
- July 25, 2026 05:00–06:00 UTC: RCE and admin access to Discourse at community.openai.com
- July 25, 2026 08:00–10:00 UTC: Bugcrowd submission
- July 25, 2026 13:30–15:30 UTC: Employee account access; harmless PoC PR opened; testing ceased
- July 25, 2026 22:49 UTC: OpenAI confirmed fix (~14 hours after submission)
- July 25–28, 2026: Discourse reported via HackerOne; fix and GHSA-vhm9-85gw-x335 advisory published
- September 1, 2026: OpenAI awarded $6,500 bounty (OpenAI-side finding only; Discourse testing excluded from bounty scope)
Technical details
Researchers found that HEIC/HEIF files in Discourse’s image pipeline passed to ImageMagick’s magick command, exposing libheif to attacker-controlled files. A heap buffer overflow in libheif 1.19.7 (Debian 12) enabled RCE. Opus 5 helped develop a reliable exploit with ASLR enabled.
The escalation vulnerability is an OpenAI SSO misconfiguration — not Discourse-specific. Compromising any first-party or third-party OpenAI service using OpenAI SSO could lead to the same access.
HEIF Heist broader campaign
The team expanded research into “HEIF Heist” tracing libheif across Slack, Meta, GitHub Enterprise, Ruby on Rails, Next.js, Astro, and Gatsby. Total research cost under $3,000 in tokens over two months for three researchers.
OpenAI paid $6,500 bounty. Discourse added ImageMagick sandboxing as defense in depth.