Hacktron published its report on September 13, 2026. Harsh Jaiswal, Mohan Pedhapati, and Rahul Maini describe two linked vulnerabilities that reached OpenAI’s internal repositories. Their work from initial discovery to repository access took less than 72 hours.

git pull
./launcher rebuild app

The first weakness was in the Discourse forum at community.openai.com. FastImage did not handle HEIF files, so Discourse sent those uploads to ImageMagick’s magick command. That exposed the libheif parser to attacker-controlled data. The team found a heap buffer overflow that enabled out-of-bounds reads and writes, followed by remote code execution. Debian security fixes had not reached the relevant packages. The Discourse image used Debian 12 with libheif 1.19.7, while Debian 13 shipped 1.19.8 at the time. Debian published a Debian 13 security update on August 8, 2026. The upstream change had appeared the previous year without a CVE or a security designation.

The researchers used AI during the exploit development. Opus 4.8 identified the missing fixes and produced a working ImageMagick and libheif exploit with ASLR disabled. It struggled to make the attack reliable with ASLR enabled. After Anthropic released Claude Opus 5.5, a new session created an ARM64 exploit for a local Mac within three hours. The team then adapted it to the x86-64 and jemalloc setup used by Discourse. By 06:00 UTC on July 25, they had confirmed local code execution through an image upload. A later autonomous /goal loop ran against the team’s own Discourse Cloud instance through rce.ee/ctf-forum, which presented the target as a CTF environment. At 10:00 UTC, the agent had obtained code execution and demonstrated it by reading /etc/hosts. The generated exploit then worked against OpenAI’s forum.

The forum’s Sign in with OpenAI flow created the second weakness. A compromise of the forum could give active users and employees access to their ChatGPT and Codex accounts. Connected services could include GitHub, Slack, and email. The researchers used an employee’s Codex account, which was connected to OpenAI’s GitHub organization, to open harmless PR #1186742 in the internal monorepo openai/openai. They did not read internal source code. The link was redacted at OpenAI’s request, and testing stopped at about 15:30 UTC.

The team found the initial remote code execution between 05:00 and 06:00 UTC on July 25. It submitted the OpenAI report through Bugcrowd between 08:00 and 10:00. OpenAI confirmed its fix at 22:49:45, about 14 hours after the report. Hacktron reported the Discourse issue through HackerOne on July 25. Discourse replied on July 26, had a fix ready on July 27, and published advisory GHSA-vhm9-85gw-x335 on July 28. It also added ImageMagick sandboxing in commit a07188016987de1613c961277e2e928aaa7c37ec. OpenAI paid a $6,500 bounty on September 1. OpenAI said that testing against the Discourse-hosted forum was excluded from its bounty program, so the award covered the OpenAI-side finding.

Hacktron places the incident within its broader HEIF Heist research. The project examined libheif exposure in Slack, Meta, GitHub Enterprise, Ruby on Rails, and Node.js frameworks such as Next.js, Astro, and Gatsby. Three researchers spent two months on the campaign and used less than $3,000 in model tokens. Adapting an exploit to a new company generally took one or two days. The team says Shopify was the only company that detected its activity, despite thousands of uploaded images and repeated image-processor crashes. Models also assisted with privilege escalation, lateral movement, and defense bypasses. Human direction remained necessary.

The researchers argue that AI is reducing the time and expertise required to turn memory bugs into practical attacks. They observed another capability increase from Opus 5 to GPT-5.6 Sol while adapting exploits without prior knowledge of the target’s libheif version, libc version, or deployment environment. They say the forum route was only one possible path, since any compromised service using OpenAI SSO could have exposed the same account access.

Self-hosted Discourse operators should rebuild their installations because older Docker images may contain the vulnerable dependency. Discourse-hosted customers have already been patched. The report recommends current security packages for libheif and libde265 through a distribution or upstream channel. The affected release families include 1.19.x, 1.20.x, 1.22.x, and 1.23.x. As of September 14, 2026, the latest upstream libheif security release was v1.23.4, and v1.23.2 had been superseded. Distribution packages can carry fixes under older version numbers. Untrusted HEIF and AVIF decoding should be disabled where unnecessary or isolated in hardened, temporary sandboxes. ImageMagick’s security policy can restrict formats and resource use.