Hacktron chained a libheif heap overflow and an OpenAI SSO flaw to reach internal repos

Security researchers at Hacktron say they combined two critical vulnerabilities — a heap buffer overflow in the libheif image library and a misconfiguration in OpenAI's single sign-on flow — to take over multiple OpenAI employees' ChatGPT and Codex accounts and reach the company's internal repositories. To prove the access without exposing any internal material, they prompted one compromised employee's Codex to open pull request #1186742 in OpenAI's internal monorepo. OpenAI paid the team a $6,500 bounty, and the write-up, published on September 13, 2026, quickly reached the front page of Hacker News.

According to Hacktron's timeline, the path from initial discovery to internal repository access took under 72 hours, with the key milestones falling on July 23–25, 2026. The work was led by Harsh Jaiswal, alongside researchers Mohan Pedhapati and Rahul Maini.

How the chain worked

The starting point was community.openai.com, OpenAI's help forum, which runs on Discourse and supports sign-in with OpenAI through auth.openai.com. Hacktron suspected that code execution on the forum, paired with a weakness in that identity flow, could open a door into wider OpenAI services.

The code-execution primitive came from Discourse's image-upload pipeline. Discourse normally screens uploads with FastImage, but because FastImage cannot parse HEIF files, those files were handed to ImageMagick's magick command, putting the libheif parser in direct contact with attacker-controlled data. A heap buffer overflow in that parser allowed out-of-bounds reads and writes while decoding HEIC files.

The gap was patch hygiene rather than a novel bug. Hacktron reports that upstream libheif changed the vulnerable code a year earlier, but the commit was never labelled a security fix and received no CVE, so the change was never prioritised for backporting. The Docker image Discourse distributes is built on Debian 12 and installed libheif 1.19.7, while Debian 13 was still shipping the vulnerable 1.19.8 during the research; Debian's security update for version 13 landed on August 8, 2026.

From forum to employee accounts

The second link was the SSO flaw. Hacktron stresses that the escalation was not Discourse-specific: any first-party or third-party service relying on OpenAI SSO could have played the same role. Until roughly two months before publication, the team says, anyone logging into the forum — ordinary user or OpenAI employee — could have had their ChatGPT and Codex accounts hijacked without any interaction. Because those accounts can be connected to GitHub, Slack and email, the potential scope extended well beyond one site.

By the morning of July 25 the researchers had confirmed remote code execution on OpenAI's forum instance through an uploaded image. They reported the vulnerability to OpenAI, then took over an employee account whose Codex was connected to OpenAI's GitHub organisation, prompted the demonstration pull request, and halted all further testing before updating their BugCrowd submission with the impact proof.

AI models built the exploits

Much of the exploit engineering was delegated to Anthropic's Claude models. An Opus 4.8 session spotted the missing backports and built a working exploit with address-space layout randomisation disabled, but repeated sessions could not make it reliable with ASLR enabled. Within hours of Opus 5's release, a new session produced a working ARM64 exploit in about three hours and ported it to the x86-64 and jemalloc setup Discourse uses. Running autonomously against Hacktron's own Discourse Cloud instance — routed through a proxy so it resembled a capture-the-flag target, since the model declined to write exploits for remote systems — the agent achieved remote code execution overnight and demonstrated it by reading /etc/hosts.

The broader effort, which Hacktron calls HEIF Heist, traced libheif into Slack, Meta, GitHub Enterprise, Ruby on Rails and Node.js frameworks including Next.js, Astro and Gatsby. It ran for two months, involved three researchers, cost under $3,000 in tokens, and typically needed only a day or two to adapt the exploit to each new target. The researchers describe clear capability jumps between model generations, including GPT-5.6 Sol.

Disclosure and fixes

Discourse received the report on a Saturday, replied on Sunday and had a fix out by Monday, and has since begun sandboxing ImageMagick. Hacktron urges anyone self-hosting Discourse to rebuild their installation — git pull followed by ./launcher rebuild app — because a web-interface update alone may not replace the underlying Docker image. Discourse-hosted customers were already patched.

Why it matters

A memory bug in an image decoder, combined with a login misconfiguration, was enough to reach an AI lab's internal source repositories through its community forum. Two lessons stand out. First, an upstream fix that is never labelled security-relevant can leave whole distributions exposed: Debian shipped vulnerable libheif across two releases because a commit carried no CVE. Second, the economics of offence have shifted — AI agents built reliable memory-corruption chains in days for a few thousand dollars of tokens, and each new model generation cleared hurdles its predecessor could not. Defenders should assume that curve continues and audit every place user-supplied images meet libheif.