Hacktron Chained libheif Flaw and OpenAI SSO Misconfiguration to Reach Internal Repos

{ "title": "Hacktron Chained libheif Overflow and OpenAI SSO Flaw to Take Over Employee ChatGPT and Codex Accounts", "body": "Hacktron researchers chained a heap buffer overflow in the libheif image library with a misconfiguration in OpenAI's single sign-on identity system to take over the ChatGPT and Codex accounts of OpenAI employees, gaining access to internal OpenAI repositories, the firm disclosed in a report covering work done in July 2026.\n\nThe team reached the internal monorepo by using a compromised employee's Codex integration to open a harmless proof-of-concept pull request, PR #1186742, in openai/openai. From initial discovery to repository access, the entire timeline took less than 72 hours.\n\nThe research was led by Harsh Jaiswal alongside Mohan Pedhapati and Rahul Maini. The three began researching frontier AI companies a few months before the report, and the work that produced the OpenAI intrusion was part of a broader, multi-month investigation the team calls HEIF Heist.\n\n## A Forum Login That Led to Codex\n\nOpenAI uses Discourse to run community.openai.com and allows users to "Sign in with OpenAI" through auth.openai.com. That combination is what turned a forum compromise into account takeover.\n\nHacktron's chain ran from the libheif image decoder, through a missing Debian security backport, into ImageMagick, which uses libheif, and then into Discourse image uploads on the OpenAI forum. From there, an OpenAI SSO identity flaw handed the researchers ChatGPT and Codex account access, and a GitHub connected integration opened the door to internal OpenAI repositories.\n\nThe team said the scope of what it could theoretically access was huge, including GitHub, Slack and emails. Asked about the escalation path, the researchers stressed that the flaw was not specific to the forum software. "We want to emphasize that the vulnerability to escalate is not Discourse-specific. It is an OpenAI SSO issue that turned the forum compromise into access to ChatGPT and Codex," the report states, adding that if any first-party or third-party OpenAI service using the OpenAI SSO was compromised, it would lead to the same access, and that "Discourse was merely one way of proofing it."\n\nThe window of exposure was wide. Until two months before the report, any user or OpenAI employee logging into community.openai.com could have had their ChatGPT and Codex accounts taken over.\n\n## From HEIC Upload to Shell on the Forum\n\nThe technical work started on July 23, 2026, when the researchers began reviewing Discourse's image-upload pipeline. They found that HEIC and HEIF files followed an unusual path. Discourse normally used FastImage for image checks, but because FastImage did not support HEIF, those files were passed to ImageMagick's "magick" command for conversion. That exposed the underlying libheif parser directly to attacker-controlled files.\n\nThe team started an Opus 4.8 session with the Discourse Docker image. The model found security fixes that had not been back-ported to the libheif package. The bug was a heap buffer overflow that produced out-of-bounds read and write primitives during HEIC decoding.\n\nThe vulnerable code had been changed upstream the previous year, but the commit was not documented as a security fix and received no CVE. "This might be a reason why Debian 12 and 13 have not received the security relevant backports in time," the researchers wrote. The Discourse Docker image was based on Debian 12, which installed vulnerable libheif version 1.19.7. Debian 13 still shipped vulnerable version 1.19.8 at the time. Debian published a security update for Debian 13 on August 8, 2026, under advisory DSA-6417-1.\n\nOn July 24, 2026, the team used Opus 4.8 to develop a working ImageMagick and libheif code-execution exploit with ASLR disabled. "We then launched several separate sessions to make it reliable against Discourse's default configuration with ASLR enabled, which wasn't fruitful," the report states.\n\nThat evening, Anthropic released Claude Opus 5. A new session with the model produced a working ARM64 exploit for a local Mac within 3 hours. The researchers then asked Opus 5 to port the exploit to the x86-64 environment and the jemalloc configuration used by Discourse. By 6:00 a.m. on July 25, 2026, they confirmed local remote code execution through an image upload.\n\nThe team placed Claude in an autonomous /goal loop against its own Discourse Cloud instance, proxied through rce.ee/ctf-forum to look like a CTF target, because Opus refused to write an exploit for remote instances. At 10:00 a.m. on July 25, the agent had achieved RCE on Discourse Cloud and demonstrated access by reading /etc/hosts. Using the generated exploit script, the researchers then got RCE on OpenAI's instance.\n\nBetween 05:00 and 06:00 UTC on July 25, 2026, Hacktron obtained RCE and administrative access to the Discourse environment at community.openai.com. After confirming no-interaction account takeover of ChatGPT and Codex accounts belonging to active forum members, the team sent its report to OpenAI.\n\n## Proving Impact Without Reading Internal Code\n\nThe researchers took over an OpenAI employee's account whose Codex was connected to OpenAI's GitHub organization. To demonstrate impact without accessing internal code, they sent a prompt to the employee's Codex account to open a pull request in OpenAI's internal monorepo. "We used the employee's Codex to open a PR #1186742 in OpenAI's internal monorepo openai/openai," the report states, explaining that this was done "to prove we had in fact gained the access we believed without allowing ourselves to learn any sensitive information." The link was redacted at OpenAI's request.\n\nThe team submitted its report through OpenAI's Bug Bounty Program on Bugcrowd between 08:00 and 10:00 UTC on July 25, 2026. Between 13:30 and 15:30 UTC it created the harmless proof-of-concept pull request, updated the Bugcrowd submission with its findings, reached out to OpenAI contacts on Twitter/X, and ceased testing at about 15:30 UTC.\n\nOpenAI replied at 22:49:45 UTC on July 25, confirming the issue was fixed, roughly 14 hours after the initial submission. OpenAI later paid a $6,500 bounty and marked the report resolved on September 1, 2026. The company clarified that testing against the Discourse-hosted community.openai.com was explicitly excluded from its bug bounty program, and that the award recognizes the OpenAI-side finding, not the actions against Discourse. Hacktron said it appreciated OpenAI's attention to detail and fast resolution of the issue.\n\n## Discourse Patched in Days and Added Sandboxing\n\nHacktron submitted its report to Discourse through HackerOne on July 25, 2026. Discourse replied on Sunday, July 26. By Monday, July 27, the company had a fix ready and had added image-processing sandboxing as defense in depth. On July 28, 2026, Discourse published advisory GHSA-vhm9-85gw-x335 with patch and rebuild guidance.\n\nThe researchers noted they had looked into the Discourse application in the past and considered it a difficult target. "We have looked into Discourse app in the past; it is actually not an easy target," they wrote.\n\nFor anyone self-hosting Discourse, the report carries a direct warning: rebuild the installation. Older Docker images may contain the vulnerable libheif dependency, which permits code execution through image upload. Administrators should run "git pull" and then "./launcher rebuild app" from /var/discourse, because a web-interface update alone may not replace the underlying image. Discourse-hosted customers were already patched.\n\n## HEIF Heist: Two Months, Three Researchers, Under $3,000\n\nThe OpenAI and Discourse intrusion was one strand of a wider campaign. HEIF Heist is a multi-month investigation tracing libheif across Slack, Meta, GitHub Enterprise, Ruby on Rails, and Node.js frameworks such as Next.js, Astro, and Gatsby. Zoom was also among the targets.\n\nThe project took two months and cost less than $3,000 in tokens in total, conducted by three researchers. Adapting the exploit to each new company usually took only one or two days. For each target, testing began with an image upload, and the team turned memory corruption into a reliable memory leak or a shell, usually without knowing the exact libheif version, libc version, or deployment environment. The AI started almost blind and adapted the exploit for each company within one or two days.\n\nDetection was rare. "We are not aware of any company that detected the activity except Shopify, even after thousands of images were sent and their image processors repeatedly crashed," the researchers wrote. When code execution landed inside a sandbox or restricted environment, the models also helped with privilege escalation, lateral movement, and bypassing existing defenses.\n\nThe team described the capability curve it observed across model releases. Opus 4.8 struggled across several sessions to produce a working exploit with ASLR enabled. Within hours of Opus 5's release, it succeeded. Across the broader campaign, the researchers saw another clear jump from Opus 5 to GPT-5.6 Sol, when they had to exploit the vulnerability without knowing anything about the target system besides that it was vulnerable.\n\nThe researchers were direct that humans remained in the loop. "This was not completly autonomous hacking, and skilled human guidance remained important, but the amount of work a small team could perform increased dramatically," they wrote.\n\n## The Economics of Exploitation Are Shifting\n\nIn an analysis section, Hacktron argued that software has long benefited from a kind of security through complexity. The code and even the vulnerability could be public, but turning a bug into a reliable exploit still required rare expertise, significant time, and knowledge of the target environment. Known memory corruption vulnerabilities were expensive to operationalize, while zero-days were mostly reserved for the highest-value targets.\n\n"This was never a real security boundary, but it protected ordinary companies in practice from software vulnerabilities," the researchers wrote. In their view, AI is removing that protection by turning more of this scarce expertise into compute. Work that once required a well-resourced team and months of effort can now be compressed into days. Security assumptions must catch up with attacker capabilities, and a realistic threat model should take into account the economics of exploitation today, instead of relying on outdated assumptions about who can carry out sophisticated attacks.\n\nThe team also flagged that the problem is not tied to a single version. HEIF Heist targets an entire ecosystem of vulnerabilities across multiple release families, including 1.19.x, 1.20.x, 1.22.x, and 1.23.x. Any deployment lacking the latest upstream security patches is potentially vulnerable. Given the complexity of the ISO base media file format and the pace of decoder updates, future memory-safety flaws are likely.\n\nAs of September 14, 2026, the latest upstream libheif security release is v1.23.4, and v1.23.2 has been superseded by further security fixes. Distribution packages may carry backported fixes under an older upstream version number, so administrators should check the package security advisory as well. The recommended update path is to install the latest security-patched libheif and libde265 packages through the distribution's security channel or from the upstream release. For defense in depth, organizations should disable untrusted HEIF and AVIF decoding where it is not needed, or isolate image-processing pipelines inside hardened, ephemeral sandboxes. ImageMagick's security policy supports restricting accepted formats and resource usage.\n\n"If your application processes user-controlled images and accepts .heic/.heif/.avif images, it is highly likely it is affected," the researchers wrote.\n\nHacktron describes its mission as helping secure the internet by finding and eliminating vulnerabilities in widely trusted software before malicious actors do. The firm brings together top CTF researchers, experienced red teamers, and offensive security researchers, and uses AI to accelerate security research. It said it is continuing research across frontier labs and other internet-critical systems. The report acknowledges Sudanshu Rajhbhar for technical assistance, and Zayne Zhang, Fabian Faessler, Robert Chen, and Jessica Ruan for proofreading, reviewing drafts, and providing feedback. Hacktron can be reached at hello@hacktron.ai.\n\n## Related on Neura Market\n\n- AI Security and Model Safety\n- OpenAI Coverage\n- Bug Bounty and Vulnerability Disclosure" }