A team of security researchers has published a detailed account of how it chained a memory-corruption bug in a widely used open-source image library with a misconfigured single sign-on setting to reach OpenAI's internal code repositories — an intrusion the company fixed in about 14 hours and acknowledged with a $6,500 bug bounty.
The writeup, published by security firm Hacktron, describes events from July 2026, when the team compromised multiple OpenAI employees' ChatGPT accounts through the company's own community forum. It drew fresh attention this week after a Hacker News discussion of the research collected several hundred upvotes. The core technical claims check out: Discourse, the forum software involved, has published a security advisory — GHSA-vhm9-85gw-x335, titled "RCE via malformed HEIF file" — describing the underlying vulnerability. For more context on this story, see our ongoing more AI stories.
The Chain: A Forum, an Image Parser and an SSO Flaw
According to Hacktron, the entry point was community.openai.com, the Discourse-powered forum where users discuss OpenAI's products. The forum allows "Sign in with OpenAI" through the company's identity infrastructure, which gave the researchers reason to believe that compromising the forum could open a path into broader OpenAI services.
The first vulnerability lived in the forum's image-upload pipeline. Discourse normally screens uploads with a library called FastImage, but FastImage does not support HEIF — the image format behind iPhone photos — so HEIC and HEIF files were passed instead to ImageMagick's magick command for conversion. That exposed the underlying libheif parser directly to attacker-controlled files.
The Discourse Docker image was built on Debian 12, which shipped a version of libheif — 1.19.7 — missing relevant security backports, Hacktron wrote. The vulnerable code had been changed upstream the previous year, but the commit was never documented as a security fix and received no CVE, which the researchers suggest is why Debian had not backported it in time. Even Debian 13 was still shipping a vulnerable version, 1.19.8, until Debian published a security update on August 8, 2026.
The second weakness was an SSO misconfiguration in OpenAI's identity infrastructure, details of which have not been published. Chained together, the two flaws meant that — until roughly two months ago, per the writeup — any user or OpenAI employee logging into the company's help forum could have had their ChatGPT and Codex accounts taken over.
Where AI Enters the Picture
What makes the disclosure notable for the AI industry is how the vulnerabilities were found. The team — Harsh Jaiswal, Mohan Pedhapati and Rahul Maini — started an AI coding session with the Discourse Docker image and asked Anthropic's Claude Opus 4.8 to inspect the installed libheif package for security issues. The model identified the missing security backports. The researchers then used AI assistance to develop a working code-execution exploit against the image library.
Hacktron had begun researching frontier AI companies specifically to find security vulnerabilities, according to the post. The episode is a compact demonstration of a trend security teams have been warning about: AI systems are now useful enough to compress vulnerability research that once took weeks into days. Hacktron says its entire timeline — from initial discovery to access to OpenAI's internal repositories — took less than 72 hours.
Proving Access Without Taking Secrets
On July 25, the team says, it used the chain to compromise multiple OpenAI employees' ChatGPT accounts. Because employees connect services like GitHub, Slack and email to ChatGPT and Codex, the researchers write that the theoretical blast radius included internal repositories and a wide range of connected tools.
Crucially, the team says it avoided reading sensitive data. To prove access without exploiting it, they used an employee's Codex instance to open a harmless pull request — number 1186742 — in OpenAI's internal monorepo, in a repository called openai/openai. The link to that pull request is redacted in the writeup at OpenAI's request. The researchers notified contacts at the company directly and ceased all further testing the same afternoon.
Fast Fix, Modest Bounty
Hacktron reported the findings through OpenAI's bug bounty program on Bugcrowd and to Discourse through HackerOne. OpenAI confirmed a fix roughly 14 hours after the initial submission, according to the writeup, and paid a $6,500 bounty. In a comment quoted by Hacktron, OpenAI noted that testing against the Discourse-hosted forum was explicitly excluded from its bug bounty's scope — the award recognized the OpenAI-side SSO finding rather than the forum compromise itself.
Discourse moved quickly as well: it had a fix ready within days and added image-processing sandboxing as defense in depth, publishing advisory GHSA-vhm9-85gw-x335 with patch and rebuild guidance. The company warned self-hosted operators to rebuild their installations from updated Docker images, since a web-interface update alone may not replace the vulnerable underlying library.
HEIF Heist: One Library, Many Victims
The OpenAI chain grew out of a broader investigation Hacktron calls HEIF Heist, a multi-month effort tracing libheif across widely used platforms including Slack, Meta, GitHub Enterprise, Ruby on Rails, and Node.js frameworks such as Next.js, Astro and Gatsby. The firm's warning is blunt: any application that processes user-controlled images and accepts .heic, .heif or .avif files is likely affected by at least some variant of the problem, and a surprising amount of widely used software depends on this one image-processing library.
For OpenAI, the incident is an uncomfortable reminder that a frontier AI lab's security perimeter is only as strong as its humblest component — in this case, an image parser inside a community forum. For everyone else, the practical takeaway is simpler: patch libheif, rebuild Discourse installations from updated images, and assume that whoever is probing your perimeter now has AI assistance.
---
Stay Ahead of AIGet the latest AI news, analysis, and breakthroughs — all in one place.
Read more AI news →
