Hacking OpenAI | Hacktron AI

Intro

On July 25, 2026, we chained two essential vulnerabilities to compromise a number of OpenAI staff’ ChatGPT accounts. With these accounts, we may then entry inside OpenAI repositories, and probably many different connectors.

To show we had the truth is gained the entry we believed with out permitting ourselves to study any delicate info, we used the worker’s Codex to open a PR #1186742 in OpenAI’s inside monorepo openai/openai.

1. libheifImage decoder
2. DebianMissing safety backport
3. ImageMagickUses libheif
4. DiscourseImage uploads
5. OpenAI discussion boardgroup.openai.com
6. OpenAI SSO Identity flaw
7. ChatGPT / CodexAccount entry
8. GitHubConnected integration
9. Internal reposOpenAI

Until two months in the past, any consumer or OpenAI worker logging into OpenAI’s personal assist discussion board (community.openai.com) may have had their ChatGPT and Codex accounts taken over. Since individuals can join numerous companies to Codex and ChatGPT, the scope of what we may theoretically entry was large, together with GitHub, Slack and emails.

The total timeline from preliminary discovery to entry to OpenAI repo entry occurred in lower than 72 hours.

We instantly reported the preliminary vulnerability to OpenAI and Discourse and labored with them to coordinate the patch. We recognize their consideration to element and quick decision of this difficulty. OpenAI additionally paid us a $6,500 bounty.

We present a full timeline of the disclosure course of right here. The remainder of the publish particulars how we found the 2 vulnerabilities, how we used claude fashions, in addition to our takeaways from this expertise.

Background

A couple of months in the past, our group at Hacktron, led by Harsh Jaiswal alongside Mohan Pedhapati and Rahul Maini, started researching frontier AI corporations to search out safety vulnerabilities. This led us to find an SSO misconfiguration in OpenAI’s identification transport systems and a libheif RCE in the neighborhood discussion board utilized by OpenAI.

We’ve since expanded the analysis into HEIF Heist, a multi-month investigation tracing libheif throughout Slack, Meta, GitHub Enterprise, Ruby on Rails, and Node.js frameworks corresponding to Next.js, Astro, and Gatsby. A surprising amount of widely-used software program relies on this one image-processing library.

If your software processes user-controlled photos and accepts .heic/.heif/.avif photos, it’s extremely probably it’s affected. Please attain out to us at [email protected] in the event you want any type of help.

Warning

Patch discover: If you self-host Discourse, rebuild your set up now. Older Docker photos might comprise a weak libheif dependency that allows code execution by a picture add. Run git pull adopted by ./launcher rebuild app from /var/discourse; a web-interface replace alone might not exchange the underlying picture. Discourse-hosted prospects have already been patched. See the security advisory.

OpenAI makes use of Discourse for his or her discussion board and permits “Sign in with OpenAI” by auth.openai.com. After getting understanding of OpenAI’s companies and transport systems, we had purpose to consider that compromising the discussion board may create a path into broader OpenAI companies by this identification stream. To check that speculation, we first wanted distant code execution on an OpenAI service just like the Discourse group discussion board.

While the Discourse app itself is definitely not a straightforward goal (we’ve got appeared into it up to now), we thought we may go after a dependency.

Heap buffer overflow in libheif

On July 23, we began reviewing Discourse’s image-upload pipeline, and we discovered that HEIC and HEIF recordsdata adopted an uncommon path. Discourse usually used QuickImage for picture checks, however as a result of QuickImage didn’t help HEIF, it handed these recordsdata to ImageMagick’s magick command for conversion.² That uncovered the underlying libheif parser on to attacker-controlled recordsdata.

We began an Opus 4.8 session with the Discourse Docker picture and requested it to examine the put in libheif package deal for safety points. After some time, it discovered that some explicit safety fixes weren’t back-ported to the libheif package deal. This allowed an heap buffer overflow resulting in OOB R/W primitives throughout HEIC decoding.

Interestingly, the weak code had been modified upstream the earlier 12 months, however the commit was not documented as a safety repair and obtained no CVE.³ This may be a purpose why Debian 12 and 13 haven’t obtained the safety related backports in time. Because Discourse’s Docker picture was based mostly on Debian 12, it put in the weak libheif model 1.19.7. Even Debian 13 nonetheless shipped the weak model 1.19.8 on the time. Since then, Debian has printed its safety replace for Debian 13 on August 8, 2026. ⁴

On July 24, we used Opus 4.8 to develop a working ImageMagick/libheif code-execution exploit with ASLR disabled. We then launched a number of separate classes to make it dependable towards Discourse’s default configuration with ASLR enabled, which wasn’t fruitful.

Opus 5 Released

That night, Anthropic launched Claude Opus 5.⁵We began a brand new session, which first produced a working ARM64 exploit for a neighborhood Mac inside 3 hours. We then requested it to port the exploit to the x86-64 atmosphere and jemalloc configuration utilized by Discourse.

By 6:00 a.m. on July 25, we had confirmed native RCE by a picture add. We then positioned Claude in an autonomous /purpose loop towards our personal Discourse Cloud occasion, proxied by rce.ee/ctf-forum to make it appear to be a CTF goal as Opus refused write exploit for distant situations.

When we checked once more at 10:00 a.m., the agent had achieved RCE on Discourse Cloud and demonstrated entry by studying /and many others/hosts. Using the generated exploit script, we managed to get RCE on OpenAI’s occasion.

After we had confirmed our speculation of no interplay account takeover of ChatGPT/Codex accounts from lively members of the discussion board, we instantly despatched our report back to OpenAI. We then took over an OpenAI worker’s account, whose Codex was linked to OpenAI’s Github group. To show influence with out truly accessing any inside code, we despatched a immediate to this worker’s Codex account to open a PR for us in OpenAI’s inside monorepo. Then we stopped any additional testing.

We up to date the BugCrowd submission with the influence proof and alerted OpenAI safety. We additionally ready a report for Discourse and reported it to their HackerOne program. Discourse obtained the report on a Saturday, replied on Sunday, and had a repair by Monday (kudos for pace). They additionally immediately started sandboxing ImageMagick.

We wish to emphasize that the vulnerability to escalate isn’t Discourse-specific. It is an OpenAI SSO difficulty that turned the discussion board compromise into entry to ChatGPT and Codex. If any first-party or third-party OpenAI service utilizing the OpenAI SSO was compromised, it will result in similar entry – Discourse was merely a technique of proofing it.

Costs of discovering these vulnerabilities

The Discourse and OpenAI hack took just a few days for an agent, and only a few hours of human time. The complete HEIF Heist analysis mission going after Slack, Zoom, Meta, adn extra took two-months, price lower than $3,000 in tokens in whole, and was performed by three researchers. Adapting the exploit to every new firm normally took just one or two days.

We noticed that each new mannequin is getting more and more succesful, as evident by the Discourse exploit introduced on this report. Opus 4.8 struggled throughout a number of classes to provide a working exploit with ASLR enabled. Within hours of Opus 5’s launch, we gave it the identical drawback and it succeeded. Across the broader marketing campaign, we noticed one other clear soar from Opus 5 to GPT-5.6 Sol, after we needed to exploit the vulnerability with out realizing something concerning the goal system apart from that it’s weak.

For every goal, testing started with a picture add. From there, we turned reminiscence corruption right into a dependable reminiscence leak or shell, normally with out realizing the precise libheif model, libc model, or deployment atmosphere. The AI began nearly blind and tailored the exploit for every firm inside one or two days. We should not conscious of any firm that detected the exercise besides Shopify, even after hundreds of photos had been despatched and their picture processors repeatedly crashed.

When code execution landed inside a sandbox or restricted atmosphere, the fashions additionally helped with privilege escalation, lateral motion, and bypassing present defenses. This was not completly autonomous hacking, and expert human steerage remained essential, however the quantity of labor a small group may carry out elevated dramatically.

Epilogue

Software has lengthy benefited from a type of safety by complexity. The code and even the vulnerability could possibly be public, however turning a bug right into a dependable exploit nonetheless required uncommon experience, important time, and data of the goal atmosphere. Known reminiscence corruption vulnerabilities had been costly to operationalize, whereas zero-days had been largely reserved for the highest-value targets.

This was by no means an actual safety boundary, however it protected abnormal corporations in observe from software program vulnerabilities. AI is eradicating that safety by turning extra of this scarce experience into compute. Work that after required a well-resourced group and months of effort can now be compressed into days.

Security assumptions should meet up with attacker capabilities. A practical menace mannequin ought to take note of the economics of exploitation at this time, as an alternative of counting on outdated assumptions ⁶ about who can perform subtle assaults.

Hacktron’s mission is to assist safe the web by discovering and eliminating vulnerabilities in broadly trusted software program earlier than malicious actors do. We are persevering with this analysis throughout frontier labs and different internet-critical techniques. If you’re answerable for securing one in every of them, we want to work with you.

Versions affected and patches

HEIF Heist isn’t tied to a single model. It targets a whole ecosystem of vulnerabilities throughout a number of launch households (e.g. 1.19.x, 1.20.x, 1.22.x, 1.23.x). Any deployment missing the newest upstream safety patches is probably weak.

• Update upstream. Install the newest security-patched libheif and libde265 packages by your distribution’s safety channel or an upstream launch. As of September 14, 2026, the newest upstream libheif safety launch is v1.23.4; v1.23.2 has been outdated by additional safety fixes. Distribution packages might carry backported fixes underneath an older upstream model quantity, so verify the package deal safety advisory as nicely.^7 4
• Defense in depth. Given the complexity of the ISO base media file format and the tempo of decoder updates, future memory-safety flaws are probably. Production architectures ought to disable untrusted HEIF/AVIF decoding the place it’s not wanted, or isolate image-processing pipelines inside hardened, ephemeral sandboxes. ImageMagick’s safety coverage helps proscribing accepted codecs and useful resource utilization. ⁸

Acknowledgements

We thank Sudanshu Rajhbhar for technical help, and Zayne Zhang, Fabian Faessler, Robert Chen, and Jessica Ruan for proofreading, reviewing drafts, and offering suggestions that improved this publish.

References

Work with the group behind this analysis.

Hacktron brings collectively high CTF researchers, skilled purple teamers, and
offensive safety researchers. We use AI to speed up safety analysis,
discovering and eliminating vulnerabilities in broadly trusted software program earlier than
malicious actors do. We’re persevering with our analysis throughout frontier labs and
different internet-critical techniques. If you’re answerable for securing one in every of
them, we’d prefer to work with you.