Glonce

Hacktron chains libheif RCE and OpenAI SSO bug to hijack ChatGPT accounts

securityThe Glonce editorsHacker News🔥80Glonce rating80Impact70Novelty65Relevance75Surprise70Players80Credibility85
Hacktron chains libheif RCE and OpenAI SSO bug to hijack ChatGPT accounts

On July 25, 2026, the security research team Hacktron, led by Harsh Jaiswal alongside Mohan Pedhapati and Rahul Maini, chained two vulnerabilities to compromise multiple OpenAI employees' ChatGPT accounts. The first was a heap buffer overflow in libheif, the image-decoding library underlying the Discourse forum software that runs OpenAI's community help forum at community.openai.com; the second was a misconfiguration in the single sign-on flow, "Sign in with OpenAI," that OpenAI's identity service at auth.openai.com exposes to that forum. Chaining the two let the researchers turn a forum compromise into access to employees' ChatGPT and Codex accounts and, from there, into whatever services those accounts had connected, including GitHub, Slack and email. To prove the access without reading anything sensitive, they used one compromised employee's Codex to open a proof-of-concept pull request, PR #1186742, in OpenAI's internal monorepo openai/openai, then stopped testing. The whole path from first finding to that internal-repo access took under 72 hours.

The libheif bug came from how Discourse handles image uploads. Discourse normally screens images with the FastImage gem, but FastImage does not support HEIC/HEIF, so those files were instead passed to ImageMagick's "magick" command for conversion, exposing the underlying libheif parser directly to attacker-controlled input. On July 23, Hacktron began reviewing that pipeline and, working with a Claude Opus 4.8 session, found that a set of security fixes to libheif had never been backported into the version Discourse's Debian-12-based Docker image shipped, libheif 1.19.7 (Debian 13 at the time still carried the similarly unpatched 1.19.8). The upstream fix had actually landed the previous year but was never flagged as a security fix and received no CVE, which the researchers say may explain why neither Debian release had it. The gap allowed a heap buffer overflow that gave out-of-bounds read/write during HEIC decoding.

Turning that memory bug into a reliable exploit is where the AI progress shows up. On July 24, Opus 4.8 built a working ImageMagick/libheif exploit against a build with ASLR disabled, but several further sessions failed to make it reliable with ASLR turned on, Discourse's default. That evening, Anthropic released Claude Opus 5, and a fresh session with it produced a working ARM64 exploit for a local Mac within about three hours, which the team then ported to the x86-64 and jemalloc memory-allocator setup Discourse actually runs. By 6 a.m. on July 25 they had confirmed local remote code execution through an image upload. To go further, they set Claude working autonomously in a "/goal" loop against their own Discourse Cloud instance, proxied through rce.ee/ctf-forum to disguise it as a capture-the-flag target, because Opus had refused to write an exploit directly against what it recognized as a real, remote system. By 10 a.m. the agent had achieved RCE on that Discourse Cloud instance, demonstrated by reading /etc/hosts, and the team then used the resulting exploit script to get RCE on OpenAI's own Discourse instance.

Disclosure moved on a tight, published timeline. Hacktron confirmed RCE and admin access to community.openai.com's Discourse environment between 05:00 and 06:00 UTC on July 25, submitted a Bugcrowd report between 08:00 and 10:00, and between 13:30 and 15:30 UTC used the account-takeover chain to demonstrate impact with the internal pull request, notifying OpenAI contacts directly and stopping all testing by about 15:30 UTC. OpenAI confirmed the fix at 22:49:45 UTC, roughly 14 hours after the initial submission, and paid a $6,500 bounty; because testing against the Discourse-hosted community.openai.com was explicitly outside the scope of OpenAI's bug bounty program, OpenAI says the award recognizes only the OpenAI-side identity finding, not the actions taken against Discourse. Hacktron separately reported the libheif bug to Discourse through HackerOne: Discourse received it on a Saturday, replied on Sunday, had a fix ready by Monday, added image-processing sandboxing as defense in depth, and published advisory GHSA-vhm9-85gw-x335 with patch and rebuild guidance. Until about two months before publication, the underlying weakness meant any user or OpenAI employee who logged into the community forum could, in principle, have had their ChatGPT and Codex accounts taken over; Hacktron stresses the escalation path is an OpenAI SSO issue, not something specific to Discourse, so any first- or third-party service using OpenAI's SSO would have been equally exposed.

The OpenAI case was part of a larger, two-month effort Hacktron calls "HEIF Heist," tracing the same libheif dependency across Slack, Meta, GitHub Enterprise, Ruby on Rails and Node.js frameworks including Next.js, Astro and Gatsby. The whole campaign, run by the three researchers, cost less than $3,000 in AI token spend, and adapting the exploit to each new target company typically took only one or two days once the technique existed. Across that broader campaign, Hacktron says it saw another capability jump, from Claude Opus 5 to GPT-5.6 Sol, when it had to exploit targets "blind," without knowing the exact libheif version, libc version or deployment details beyond the fact that the target was vulnerable; testing began with an image upload and the memory corruption was then turned into a leak or a shell, with the models also helping with privilege escalation and lateral movement once inside a sandbox. Hacktron says it is not aware of any targeted company detecting the probing except Shopify, even though thousands of test images were sent and image processors repeatedly crashed.

Hacktron frames the broader point as the erosion of "security through complexity": known memory-corruption bugs used to require rare expertise and months of work to turn into reliable exploits, which in practice protected ordinary companies even though it was never a real security boundary; AI is compressing that work, in this case turning a months-scale problem into days. The team argues realistic threat models now need to account for the economics of exploitation rather than older assumptions about who can mount sophisticated attacks, and says it will keep applying the same research across other frontier labs and internet-critical systems.

For anyone running an affected system, HEIF Heist is not tied to one libheif version; it spans release families including 1.19.x, 1.20.x, 1.22.x and 1.23.x, and any deployment without the latest upstream security patches is potentially vulnerable. Self-hosted Discourse operators are told to rebuild immediately via git pull and ./launcher rebuild app rather than trust a web-interface update alone, since that may not replace the underlying vulnerable image; Discourse Cloud customers were already patched. As of September 14, 2026, the latest upstream libheif security release is v1.23.4, superseding the earlier v1.23.2 fix.

Key facts

  • Hacktron (Harsh Jaiswal, Mohan Pedhapati, Rahul Maini) chained a libheif heap buffer overflow in Discourse's image-upload pipeline with an OpenAI SSO misconfiguration to hijack multiple OpenAI employees' ChatGPT and Codex accounts on July 25, 2026.
  • Using a hijacked employee's Codex, the researchers opened proof-of-concept pull request #1186742 in OpenAI's internal monorepo openai/openai without viewing sensitive code, reaching that access within less than 72 hours of first discovery.
  • Claude Opus 4.8 could not reliably exploit the bug with ASLR enabled; a new session with Claude Opus 5, released that same evening, produced a working ARM64 exploit in about three hours and was then ported to Discourse's x86-64/jemalloc setup.
  • OpenAI confirmed its fix roughly 14 hours after the Bugcrowd report and paid a $6,500 bounty covering only the OpenAI-side finding (Discourse-hosted testing was excluded from OpenAI's bounty scope); Discourse published advisory GHSA-vhm9-85gw-x335 with a Monday patch.
  • The wider "HEIF Heist" campaign tested Slack, Meta, GitHub Enterprise, Zoom, Shopify and others over two months for under $3,000 in AI token costs with three researchers; only Shopify detected the probing.

Why it matters

The case shows AI models autonomously closing the gap between a known memory-corruption bug and a working, reliable exploit. Claude Opus 4.8 could not make the libheif exploit work with ASLR enabled after several sessions; a new session with Claude Opus 5, released the same evening, did it in about three hours, and Hacktron says it saw a further jump to GPT-5.6 Sol when exploiting targets blind. Work that used to demand rare human expertise and months of effort was compressed into days, and the account-takeover chain shows how a single overlooked dependency in forum software can cascade into access to a frontier lab's internal code repository.

Who it affects

Directly, users and employees of OpenAI's community forum, community.openai.com, whose ChatGPT and Codex accounts could have been taken over through the forum's SSO link to auth.openai.com; that path is already patched. More broadly, anyone self-hosting Discourse on an unpatched libheif version, and any application that accepts user-uploaded .heic/.heif/.avif images, since Hacktron traced the same vulnerable libheif dependency into Slack, Meta, GitHub Enterprise, Ruby on Rails, Next.js, Astro and Gatsby.

How to use it

Self-hosted Discourse operators should rebuild now: run git pull followed by ./launcher rebuild app from /var/discourse, since a web-interface update alone may not replace the vulnerable underlying image; Discourse Cloud customers are already patched. Anyone shipping software that processes user-controlled HEIC/HEIF/AVIF images should update to the latest security-patched libheif and libde265 packages through their distribution's security channel, checking the package advisory since backported fixes can carry an older version number; as of September 14, 2026 the latest upstream libheif security release is v1.23.4, which supersedes the earlier v1.23.2 fix.

How solid is it

This is a first-party writeup from the researchers who found and disclosed the bugs, with a stated hour-by-hour timeline, a documented Bugcrowd and HackerOne process, an OpenAI-confirmed fix, a paid $6,500 bounty and a public Discourse security advisory (GHSA-vhm9-85gw-x335) with a real patch. Both companies' own actions, confirming and shipping fixes, corroborate the account, and Hacktron says it deliberately avoided reading sensitive OpenAI data and had the proof-of-concept pull request's link redacted at OpenAI's request. No CVE number is given for either of the two OpenAI/Discourse bugs themselves.

Risks and caveats

The source does not name the compromised OpenAI employees or say what internal code or systems, if any, were actually viewed beyond the harmless proof-of-concept pull request. It does not break down how the $6,500 bounty splits between the SSO bug and the libheif RCE, or say whether Discourse paid anything, only that Discourse-hosted testing was explicitly excluded from OpenAI's own bug bounty program. It also does not give a total count of companies tested across the broader HEIF Heist campaign, naming only a handful as examples. The account is self-reported by the same team that found the bugs and, in part, ran the exploit against OpenAI's live infrastructure before disclosure.

“Security assumptions must catch up with attacker capabilities.”

— Hacktron, in the disclosure writeup's epilogue