A chained vulnerability pair gave researchers access to OpenAI employee ChatGPT and Codex accounts in under 72 hours, exposing how a misconfigured single sign-on flow plus an unpatched image decoder can turn a public forum into a path into a frontier AI company’s internal tooling. OpenAI paid a $6,500 bounty, Discourse shipped a patch within days, and the underlying image library is still present across a wide swath of internet software.
What the chain exploited
The first link was a heap buffer overflow in libheif, the decoder used to handle HEIC, HEIF, and AVIF images. Discourse normally checks uploads with FastImage, but because FastImage does not support HEIF, those files are handed to ImageMagick’s magick command, which links directly against libheif. The package shipped in Discourse’s Debian 12 base image (libheif 1.19.7) was missing a security fix that had landed upstream the previous year. Debian 13 also shipped a vulnerable build (1.19.8) at the time, and a Debian security update did not arrive until August 8, 2026.
The second link was an OpenAI single sign-on misconfiguration on community.openai.com. The forum accepted “Sign in with OpenAI” through auth.openai.com, so any account that could be taken over on the forum inherited the identity of its owner across OpenAI services. Discourse was not the root weakness: any first-party or third-party OpenAI service using the same SSO could have produced the same outcome if it had been compromised.
Putting the two together turned an image upload on a public help forum into access to ChatGPT, Codex, and any connector those accounts had linked, including GitHub, Slack, and email. With Codex connected to OpenAI’s GitHub organization, the researchers could open a pull request inside OpenAI’s internal monorepo.
How the proof of concept was built
Review of the Discourse Docker image turned up the unpatched libheif on July 23. An initial session with Claude Opus 4.8 produced a working local exploit with ASLR disabled but could not make it reliable against Discourse’s default ASLR-enabled configuration. The same evening, Anthropic released Claude Opus 5. A fresh session produced a working ARM64 exploit for a local Mac within three hours, then ported it to the x86_64 and jemalloc configuration Discourse uses. By 6:00 a.m. on July 25, local code execution through an image upload was confirmed.
The exploit was then run against a controlled Discourse Cloud instance proxied through a capture-the-flag-style target, where the agent achieved remote code execution and read /etc/hosts. The same script was then used against OpenAI’s forum instance.
Disclosure timeline
July 25, 2026, 05:00 to 06:00 UTC: remote code execution and administrative access obtained on community.openai.com. 08:00 to 10:00 UTC: report submitted through OpenAI’s Bug Bounty Program on Bugcrowd. 13:30 to 15:30 UTC: a proof-of-concept pull request was opened in OpenAI’s internal monorepo, the Bugcrowd report was updated with impact details, OpenAI was notified directly, and all further testing was halted. 22:49:45 UTC: OpenAI confirmed the issue was fixed, roughly 14 hours after submission.
Discourse received the report on July 25 via HackerOne, replied the next day, had a fix ready by July 27, and published advisory GHSA-vhm9-85gw-x335 on July 28. The fix also added ImageMagick sandboxing as defense in depth. On September 1, 2026, OpenAI paid a $6,500 bounty and marked the report resolved, noting that the forum itself was outside the bounty scope and the award covered the OpenAI-side finding.
Why this matters beyond OpenAI
The vulnerable libheif is not unique to Discourse. The same research project, named HEIF Heist, traced the same class of flaw through Slack, Meta, GitHub Enterprise, Ruby on Rails, and Node.js frameworks including Next.js, Astro, and Gatsby. Any application that processes user-controlled images and accepts .heic, .heif, or .avif files is likely affected. Adapting the exploit to each new target usually took one or two days, and the broader campaign cost less than $3,000 in tokens across two months of work by three researchers.
Across the campaign, the researchers report a clear jump in capability between Opus 4.8 and Opus 5, and another between Opus 5 and GPT-5.6 Sol, when exploits had to be built against targets where nothing was known beyond the fact that the image processor was vulnerable. The models started close to blind on each target and adapted to unknown libheif versions, libc versions, and deployment environments within one or two days. None of the targeted companies detected the activity except Shopify, even after thousands of images were sent and image processors repeatedly crashed.
What to patch and how
Self-hosted Discourse installations should be rebuilt now. Older Docker images may carry the vulnerable libheif dependency, and a web-interface update alone may not replace the underlying image. Run git pull followed by ./launcher rebuild app from /var/discourse. Discourse-hosted customers have already been patched.
For any other deployment that handles user-supplied images: install the latest security-patched libheif and libde265 packages through the distribution’s security channel or an upstream release. As of September 14, 2026, the latest upstream libheif security release is v1.23.4, and v1.23.2 has been superseded by further fixes. Distribution packages may carry backported fixes under an older upstream version number, so the package’s own security advisory is the source of truth.
Given the complexity of the ISO base media file format and the pace of decoder updates, future memory-safety flaws in this area are likely. Production systems should disable untrusted HEIF and AVIF decoding where it is not needed, or isolate image-processing pipelines inside hardened, ephemeral sandboxes. ImageMagick’s security policy supports restricting accepted formats and resource usage.
The bigger shift in attacker economics
Software has long relied on a kind of security through complexity. A vulnerability can be public, but turning a bug into a reliable exploit has historically required rare expertise, significant time, and detailed knowledge of the target. Known memory-corruption flaws were expensive to operationalize, and zero-days were largely the territory of well-resourced attackers. AI is compressing that expertise into compute. Work that once required a team and months can now be done by a small group in days. Threat models that assume only sophisticated attackers can chain complex vulnerabilities need to be updated to reflect what off-the-shelf models can do today.
FAQ
What was the vulnerability that led to the OpenAI ChatGPT account takeover?
A chained exploit combining a heap buffer overflow in the libheif image decoder used by Discourse and an OpenAI single sign-on misconfiguration on community.openai.com. Compromising the forum through a crafted HEIF image allowed takeover of any signed-in user’s ChatGPT and Codex accounts, including those of OpenAI employees.
How long did it take OpenAI and Discourse to fix the issue?
OpenAI confirmed the fix roughly 14 hours after the July 25, 2026 Bugcrowd submission. Discourse received the report via HackerOne on July 25, replied on July 26, had a fix ready by July 27, and published advisory GHSA-vhm9-85gw-x335 on July 28.
Was a bug bounty paid for the OpenAI forum compromise?
Yes. OpenAI paid a $6,500 bounty on September 1, 2026. OpenAI noted that testing against the Discourse-hosted community.openai.com was excluded from its bug bounty program, and the award was for the OpenAI-side finding, not the actions against Discourse.
Related coverage
This article summarizes reporting from hacktron.ai. See our editorial disclaimer for how our articles are produced.
Run a free scan to see your AI Visibility Score, SEO rating, and local citation accuracy.