Key actions

  • Patch libheif – Update the libheif package in the Discourse Docker image to the latest upstream version that fixes the heap-buffer-overflow. Verify with:
dpkg -l | grep libheif

Table of Contents

Overview and Background

Initial Discovery and Motivation

Therefore, they identified two critical issues: an SSO misconfiguration in OpenAI’s identity infrastructure and a libheif RCE in the community forum that OpenAI uses. Consequently, the team could chain these vulnerabilities to compromise multiple OpenAI employee accounts.

Timeline Summary (72-hour Compromise)

Conclusion – Prompt patching, strict validation, isolated authentication flows, and continuous monitoring are essential to prevent similar multi-vector attacks.

Vulnerability Discovery

OpenAI SSO identity flaw

OpenAI uses Discourse for their forum and allows “Sign in with OpenAI” through auth.openai.com. After getting a good understanding of OpenAI’s services and infrastructure, we had reason to believe that compromising the forum could create a path into broader OpenAI services through this identity flow.

libheif heap buffer overflow in Discourse image pipeline

On July 23, we started reviewing Discourse’s image-upload pipeline, and we found that HEIC and HEIF files followed an unusual path. Discourse normally used FastImage for image checks, but because FastImage did not support HEIF, it passed those files to ImageMagick’s magick command for conversion. That exposed the underlying libheif parser directly to attacker-controlled files. We started an Opus 4.8 session with the Discourse Docker image and asked it to inspect the installed libheif package for security issues. After a while, it found that some particular security fixes were not back-ported to the libheif package. This allowed an heap buffer overflow leading to OOB R/W primitives during HEIC decoding. Interestingly, the vulnerable code had been changed upstream the previous year, but the commit was not documented as a security fix and received no CVE. This might be a reason why Debian 12 and 13 have not received the security relevant backports in time. Because Discourse’s Docker image was based on Debian 12, it installed the vulnerable libheif version 1.19.7. Even Debian 13 still shipped the vulnerable version 1.19.8 at the time. Since then, Debian has published its security update for Debian 13 on August 8, 2026.

Exploit Development and Account Takeover

Image-upload RCE on Discourse (local and remote)

On July 24, we used Opus 4.8 to develop a working ImageMagick/libheif code-execution exploit with ASLR disabled. We then launched several separate sessions to make it reliable against Discourse’s default configuration with ASLR enabled, which wasn’t fruitful.

We started a new session, which first produced a working ARM64 exploit for a local Mac within 3 hours. We then asked it to port the exploit to the x86-64 environment and jemalloc configuration used by Discourse. By 6:00 a.m. on July 25, we had confirmed local RCE through an image upload. We then placed Claude in an autonomous /goal loop against our own Discourse Cloud instance, proxied through rce.ee/ctf-forum to make it look like a CTF target as Opus refused write exploit for remote instances. When we checked again at 10:00 a.m., the agent had achieved RCE on Discourse Cloud and demonstrated access by reading /etc/hosts. Using the generated exploit script, we managed to get RCE on OpenAI’s instance.

Cross-product account takeover via Codex and PR proof

After we had confirmed our hypothesis of no interaction account takeover of ChatGPT/Codex accounts from active members of the forum, we immediately sent our report to OpenAI. We then took over an OpenAI employee’s account, whose Codex was connected to OpenAI’s Github organization. To demonstrate impact without actually accessing any internal code, we sent a prompt to this employee’s Codex account to open a PR for us in OpenAI’s internal monorepo. Then we stopped any further testing.

Responsible Disclosure, Patch Deployment, and Bounty

Bugcrowd submission and OpenAI coordination

After confirming the cross-product impact, the team coordinated internally on the responsible disclosure process and submitted a report through OpenAI’s Bug Bounty Program on Bugcrowd.

Discourse HackerOne report and rapid fix

We submitted a report to Discourse through its HackerOne program. Discourse received the report on a Saturday, replied on Sunday, and had a fix by Monday (kudos for speed). They also immediately started sandboxing ImageMagick.

OpenAI bounty award and scope clarification

OpenAI also paid us a $6,500 bounty. OpenAI comment — To clarify the scope of that award: testing against the Discourse-hosted community.openai.com was explicitly excluded from our bug bounty program. The award recognizes the OpenAI-side finding, not the actions against Discourse.

Impact Assessment and Potential Reach

Cross-product implications of compromised accounts

Until two months ago, any user or OpenAI employee logging into OpenAI’s own help forum (community.openai.com) could have had their ChatGPT and Codex accounts taken over. Since people can connect various services to Codex and ChatGPT, the scope of what we could theoretically access was huge, including GitHub, Slack and emails.

Scope of access through Codex and ChatGPT integrations

We took over an OpenAI employee’s account, whose Codex was connected to OpenAI’s Github organization. To demonstrate impact without actually accessing any internal code, we sent a prompt to this employee’s Codex account to open a PR for us in OpenAI’s internal monorepo.

Mitigation Steps for Discourse and OpenAI Services

Rebuilding Discourse Docker installations

Patch notice: If you self-host Discourse, rebuild your installation now. Older Docker images may contain a vulnerable libheif dependency that permits code execution through an image upload. Run git pull followed by./launcher rebuild app from /var/discourse; a web-interface update alone may not replace the underlying image.

Enabling ImageMagick sandboxing and other defenses

Discourse had a fix ready by Monday and added image-processing sandboxing as defense in depth.

Cost of Vulnerability Research

The Discourse and OpenAI hack took a few days for an agent, and just a few hours of human time. The whole HEIF Heist research project going after Slack, Zoom, Meta, adn more took two-months, cost less than $3,000 in tokens in total, and was conducted by three researchers. Adapting the exploit to each new company usually took only one or two days.

Acknowledgements and References

We appreciate the attention to detail and fast resolution from OpenAI and Discourse. For further information or assistance, please reach out to us at hello@hacktron.ai.

Keywords: hacking openai, hacking, openai