According to a post on Hacktron.ai, on July 25 2026 the team chained two critical vulnerabilities to compromise multiple OpenAI employees’ ChatGPT and Codex accounts. The first flaw was a heap buffer overflow in the libheif image‑processing library used by Discourse, the forum software powering community.openai.com. The second was an SSO misconfiguration in OpenAI’s identity infrastructure that allowed an attacker who controlled a forum account to take over linked services such as ChatGPT, Codex, GitHub, Slack and email. Using the overflow, the researchers gained remote code execution and administrative access to the Discourse environment hosted at community.openai.com. They then demonstrated that an employee’s Codex account, which was connected to OpenAI’s GitHub organization, could be hijacked. To prove impact without accessing sensitive code, they prompted the compromised Codex to open a pull request numbered #1186742 in OpenAI’s internal monorepo openai/openai (the link was redacted at OpenAI’s request). The timeline from initial discovery to repository access was less than 72 hours. At 05:00–06:00 UTC the team obtained RCE and admin rights on the Discourse instance. By 08:00–10:00 UTC they submitted a report through OpenAI’s Bug Bounty Program on Bugcrowd. Between 13:30 and 15:30 UTC they accessed an employee account, created the proof‑of‑concept PR, notified OpenAI security via Twitter/X and halted further testing. OpenAI confirmed the fix at 22:49:45 UTC, roughly 14 hours after the submission. The libheif vulnerability stemmed from missing security backports; the Discourse Docker image was based on Debian 12 and shipped libheif 1.19.7, while Debian 13 still shipped the vulnerable 1.19.8 at the time. Debian published a security update for version 13 on August 8 2026. The researchers developed an exploit using Opus 4.8 and later Claude Opus 5.5, achieving reliable RCE against Discourse’s default configuration with ASLR enabled. Discourse was notified through its HackerOne program, responded the same day, had a fix ready by Monday, and published advisory GHSA‑vhm9‑85gw‑x335 with rebuild guidance. OpenAI awarded a $6,500 bounty, noting that the payment recognized the OpenAI‑side finding, not the actions against Discourse. The researchers emphasized that they reported the issue promptly, worked with both vendors to coordinate patches, and refrained from any further testing after demonstrating impact.
Key facts
- July 25 2026: heap overflow in libheif + SSO misconfiguration used to hijack OpenAI employee accounts
- Proof‑of‑concept: opened PR #1186742 in internal monorepo via compromised Codex
- Timeline: <72 hours from discovery to repo access
- Bounty: $6,500 from OpenAI; Discourse fixed and published GHSA‑vhm9‑85gw‑x335
- Affected libheif versions: 1.19.7 (Debian 12) and 1.19.8 (Debian 13) before Aug 8 2026 security update