Hacktron hacked OpenAI via heap overflow + SSO flaw
Original: Hacking OpenAI
Why This Matters
The breach shows how a dependency-level image parsing bug can chain all the way into a major AI company's internal codebase.
On July 25, 2026, security firm Hacktron chained a heap buffer overflow in libheif with an SSO misconfiguration on community.openai.com to compromise multiple OpenAI employee ChatGPT and Codex accounts, gaining access to an internal OpenAI monorepo. OpenAI paid a $6,500 bug bounty.
Hacktron researchers Harsh Jaiswal, Mohan Pedhapati, and Rahul Maini disclosed a two-vulnerability exploit chain that gave them access to OpenAI's internal GitHub repositories. The attack path started at community.openai.com, OpenAI's Discourse-powered help forum. A heap buffer overflow in libheif — the image decoder used by ImageMagick, which Discourse calls for image uploads — allowed the team to achieve remote code execution and administrative access to the Discourse environment within the first hour on July 25, 2026. From there, an SSO identity flaw let them pivot from the compromised forum into actual ChatGPT and Codex accounts belonging to OpenAI employees. Because Codex supports integrations with GitHub, Slack, and email, the theoretical blast radius was substantial. To prove access without reading sensitive data, the team used an employee's Codex to open pull request #1186742 in OpenAI's internal monorepo 'openai/openai'. The full chain — from initial discovery to repo access — took under 72 hours. The team used Claude models during parts of the research process. OpenAI and Discourse were notified immediately via Bugcrowd, patches were coordinated, and OpenAI paid a $6,500 bounty.