Summary
Hacktron says researchers chained a libheif image-decoding flaw with an OpenAI SSO misconfiguration to access an employee’s ChatGPT and Codex account and create a proof-of-concept pull request in an internal repository. The company says Claude models helped develop the exploit, while human guidance remained necessary.
Security researchers at Hacktron say they chained a memory-safety flaw in the libheif image-processing library with an OpenAI single sign-on (SSO) misconfiguration to reach OpenAI employee accounts. The team used the compromised access to create a harmless pull request in OpenAI’s internal monorepo as proof of impact, and says Claude models helped develop and adapt the exploit.
Hacktron reported the findings to OpenAI and Discourse on July 25, 2026. OpenAI confirmed its side of the issue had been fixed roughly 14 hours after the initial submission. Discourse prepared a fix by July 27 and published an advisory on July 28.
Contents
How the attack path worked
The first vulnerability was in the image-upload path of community.openai.com, a forum operated using Discourse. HEIC and HEIF images were sent to ImageMagick for conversion because Discourse’s usual image-checking component did not support those formats. That exposed the libheif decoder to attacker-controlled files.
Hacktron says the Discourse container used a Debian 12 package containing libheif version 1.19.7 without relevant security backports. The researchers identified a heap buffer overflow in the decoder. Such an error can allow data to be read or written outside the memory allocated for a program; in this case, Hacktron developed it into remote code execution, meaning code could run on the server processing the image.
The second part of the chain involved OpenAI’s SSO configuration. According to Hacktron, compromise of the forum could be turned into access to ChatGPT and Codex accounts belonging to active forum members. The researchers then accessed an OpenAI employee’s Codex account, which was connected to OpenAI’s GitHub organisation. Rather than read internal code, they instructed Codex to open pull request #1186742 in the internal openai/openai monorepo. The repository link was later redacted at OpenAI’s request.
The researchers stopped testing at approximately 15:30 UTC on July 25 after updating the OpenAI report with the proof of impact.
Where Claude helped
Hacktron says an earlier session using Opus 4.8 identified missing security fixes in the installed libheif package. The researchers used the model to develop an ImageMagick/libheif exploit, although their initial attempts were not reliable against the target’s default memory-randomisation protections.
After a newer Claude Opus release, Hacktron says the model produced a working ARM64 exploit for a local Mac within three hours and helped port it to the x86-64 environment and jemalloc configuration used by Discourse. By 06:00 UTC on July 25, the team had confirmed local code execution through an image upload. Later, the model achieved code execution against a Discourse Cloud test environment and demonstrated it by reading /etc/hosts.
Hacktron describes the operation as assisted rather than fully autonomous. Human researchers selected targets, interpreted results, coordinated disclosure and adapted the testing process. The company’s broader conclusion is that AI reduced the time needed to turn a known memory-corruption bug into a working exploit across different environments.
Patches and the wider security lesson
Hacktron says Discourse-hosted customers had been patched and that Discourse added ImageMagick sandboxing as an additional protection. The company advises operators to install the latest security-patched libheif and libde265 packages through their distribution or upstream release channels. It lists libheif version 1.23.4 as the latest upstream security release on September 14, 2026, while noting that distributions can provide fixes under older upstream version numbers.
The report also recommends restricting unnecessary HEIF and AVIF decoding or isolating image-processing workloads inside hardened, short-lived sandboxes. These measures address the risk that future decoder vulnerabilities could be reached through untrusted image files.
OpenAI awarded Hacktron a $6,500 bounty for the OpenAI-side finding. OpenAI clarified that testing against the Discourse-hosted forum was excluded from its bounty programme, so the award covered the SSO-related issue rather than the Discourse vulnerability itself.