518/69 Monday, September 21, 2026
Researchers from Hacktron disclosed the results of a security test in which they were able to take over ChatGPT and Codex accounts belonging to OpenAI staff through a vulnerability in a forum system running Discourse. The attack did not rely on phishing or leaked passwords, but stemmed from the image upload process on OpenAI’s Help Forum, which used “Sign in with OpenAI” together with other services. The vulnerability was related to the processing of HEIC and HEIF image files passed to ImageMagick and decoded using libheif. This resulted in a heap buffer overflow vulnerability that could allow an attacker to read or write data outside the intended memory boundaries. Although the vulnerability had already been fixed upstream the previous year, it did not have a CVE identifier and had not been backported to Debian in time.
The report stated that AI played a key role in accelerating exploit development. The researchers first tested the issue with Claude Opus 4.8, but were unable to produce a working exploit when protections such as ASLR were enabled. After Anthropic released Opus 5, the researchers tested the same challenge again, and the AI was able to help create a working exploit in a local test environment within only a few hours. The exploit was then adjusted to match the real Discourse server environment. The researchers stated that once they confirmed system access, they used the hijacked Codex account of an employee to open a single non-impactful pull request in an internal OpenAI repository to prove the possibility of account takeover. They did not read source code, did not merge the pull request, and did not deploy any code, before reporting the vulnerability to OpenAI and Discourse.
OpenAI confirmed that it fixed the issue within approximately 14 hours after receiving the report and awarded a USD 6,500 bug bounty. The company stated that the reward covered the OpenAI-side issue, not direct testing against the Discourse-hosted community. Discourse also released a patch and added sandboxing around the image-processing workflow to further reduce risk. Hacktron’s report stated that the key issue was not only a vulnerability in a forum or image library, but also the risk of identity architecture, where a lower-trust public service shares single sign-on (SSO) with sensitive internal services. If such a system is compromised, it may lead to access to other linked services. Organizations should review the actual versions of libheif used in systems that support HEIC, HEIF, or AVIF files, and carefully reassess SSO design between public-facing services and critical internal systems.