Hacking OpenAI

On July 25, we hacked OpenAI.

Two bugs let us take over ChatGPT/Codex accounts of OpenAI employees (+some unaffiliated users) and reach connected services: Outlook, Slack, GitHub, etc.

We proved it with a PR in OpenAI’s internal codebase . It took us <72h. 🧵

At a high level, this was the full exploit chain.

1. HEIC/HEIF upload
2. ImageMagick decoding
3. Heap overflow on libheif
4. RCE on https://community.openai.com/
5. Critical OpenAI SSO flaw
6. ChatGPT/Codex takeover
7. Connected GitHub access
8. Internal repo PR #1186742

The image package libheif had a known vulnerability, fixed upstream, but the fix never flagged as security-relevant and was still present in Discourse. Uploading a HEIF file gave us RCE on the OpenAI forum https://community.openai.com/.

https://github.com/strukturag/libheif/commit/85e21ad44eba931314337300a2376b8d28f085ae

The second bug is more serious: an OpenAI SSO vulnerability.

Using this flaw, we turned our Discourse forum exploit into access to ChatGPT and Codex accounts belonging to people who had signed into it, including OpenAI employees.

Those accounts could be (and some were) connected to Outlook, Gmail, Google Drive, Slack, GitHub, and other services via Codex or ChatGPT. This made the potential impact much larger than ChatGPT alone.

To demonstrate impact while minimising exposure, we used one affected employee account connected to OpenAI’s GitHub org.

Codex created a harmless PR in their internal monorepo without us reading sensitive code. That proved to us that the access was real.

We reported the bug to Discourse and OpenAI. OpenAI fixed the SSO issue roughly 14 hours after our initial submission.

Discourse received our separate report Saturday, replied Sunday, and had a fix Monday.

OpenAI awarded us $6,500.

AI agents did a meaningful share of the exploit work.

Opus 4.8 found the libheif vulnerability and built a partial exploit. Hours after Opus 5 launched, it adapted the exploit to Discourse and achieved RCE on our test instance.

Our main takeaway from hacking OpenAI: AI is reducing the amount of scarce expertise needed to develop exploits. Work that once took months can now take days.

Even leading AI labs can be vulnerable.

Defenders need to fix the architecture, patch faster, and limit the blast radius of connected things.

This work was done by our team @HacktronAI led by @rootxharsh along with me and @iamnoooob.

We have published the full details of the exploit chain, as well as how we discovered it, on our blog here:

https://hacktron.ai/blog/hacking-openai

also we are not some random dudes, check our work before, we work with companies like perplexity and vercel.

https://www.hacktron.ai/blog/

Check out @LiveOverflow video https://www.youtube.com/watch?v=gjHh9g7yo9Y

After we hacked openai, we started looking into other companies that was affected by same image parser, the bug affects numerous companies including slack, github ent, meta etc.

https://x.com/rootxharsh/status/2100801820960620574

multiple labs use slack, we could've leaked every private images and other files uploaded to slack

https://x.com/rootxharsh/status/2100801830779572430?s=20

HACKTRON

Hacking OpenAI

1186742

Exploit chain

libheif (Image decoder) → Debian (Missing security backport) → ImageMagick (Uses libheif) → Discourse (Image uploads) → OpenAI forum (community.openai.com) → OpenAI SSO (Identity flaw) → ChatGPT / Codex (Account access) → GitHub (Connected integration) → Internal repos (OpenAI)

EXPLOIT TIMELINE

23 Jul: Found the bug — We traced Discourse's HEIF upload path through ImageMagick to libheif and found the heap overflow.

24 Jul: First working exploit — Opus 4.8 got code execution working with ASLR disabled.

25 Jul · 06:00 UTC: Reliable local RCE — Opus 5 turned it into a working image-upload exploit with ASLR on.

25 Jul · 10:00 UTC: RCE on community.openai.com — The exploit worked against our Discourse Cloud instance, then OpenAI's forum.

25 Jul · 13:30-15:30 UTC: Opened the proof-of-access PR — We used an employee's Codex account to open a harmless PR in OpenAI's internal monorepo, then stopped testing.

Commit 85e21ad by farindk on May 6, 2025: simplify overlay overlap area computation. 2 files changed, +36 -34. Tags: master, v1.23.4, v1.20.0. Parent: d506eac. File: libheif/image-items/overlay.cc. Diff replaces const uint32_t high_bit = 0x80 << ((len - 1) * 8); with const uint32_t high_bit = UINT32_C(0x80) << ((len - 1) * 8); inside readvec_signed.

chatgpt.com/codex/cloud/tasks/task_b_6aa848cec00ec832199daa1fb0979caa3 — Update README.md with new title — Sep 15 — not-openai/openai — branch codex/update-readme.md-with-new-title — +1 -3.

Task: Update README.md to "Hacktron AI team PoC". Worked for 2m 7s. Summary: Replaced the README contents with 'Hacktron AI team PoC.' Committed the change in commit 1c12d2a and created the pull request metadata. Testing: git diff --check; cat README.md; git status --short --branch — working tree is clean. Diff removes "# Not OpenAI Monorepo" and "This is not-OpenAI Monorepo"; adds "Hacktron AI team PoC".

OpenAI asked us not to include the original screenshot in this report. The image above is a reconstructed representation for illustrative purposes.

25 July 2026 | 05:00-06:00 UTC • Initial Finding — HacktronAI team obtained remote code execution (RCE) and administrative access to the Discourse environment hosted at community.openai.com.

25 July 2026 | 08:00-10:00 UTC • Bugcrowd Submission — After confirming the cross-product impact, the team coordinated internally on the responsible disclosure process and submitted a report through OpenAI’s Bug Bounty Program on Bugcrowd.

25 July 2026 | 13:30-15:30 UTC • OpenAI Employee Account Access & Proof of Concept — To demonstrate the practical impact of the vulnerability, we created a harmless proof-of-concept pull request in OpenAI’s internal monorepo (link redacted at OpenAI’s request). We updated the existing Bugcrowd submission with these findings, reached out to friends at OpenAI on Twitter/X to notify them directly, and ceased all further testing at approximately 15:30 UTC.

25 July 2026 | 22:49:45 UTC • OpenAI-Side Fix Confirmed — OpenAI replied to the report confirming the issue had been fixed, roughly 14 hours after the initial submission.

25 July 2026 • Discourse Reported via HackerOne — We submitted a report to Discourse through its HackerOne program.

26 July 2026 • Discourse Responded — Discourse replied to the report on Sunday.

27 July 2026 • Discourse Fix Ready — Discourse had a fix ready by Monday and added image-processing sandboxing as defense in depth.

28 July 2026 • Discourse Advisory Published — Discourse published GHSA-vhm9-85gw-x335 with patch and rebuild guidance.

01 Sep 2026 ○ OpenAI Rewarded $6,500 Bounty and Marked Resolved — OpenAI comment – To clarify the scope of that award: testing against the Discourse-hosted community.openai.com was explicitly excluded from our bug bounty program. The award recognizes the OpenAI-side finding, not the actions against Discourse.