OpenAI monorepo reached via libheif and SSO flaws

Three researchers at Hacktron chained two ordinary-looking bugs into access to OpenAI's internal code repository, and published how they did it. The chain started with an image file uploaded to OpenAI's public help forum. It ended with a pull request opened inside the company's private monorepo, less than 72 hours after the work began.

Neither bug was exotic. The first was a heap buffer overflow in libheif, the library that decodes HEIF and HEIC images, the format an iPhone produces by default. The second was a single sign-on setting that trusted the forum too much. The write-up from Hacktron describes the combination as the real finding, not either half.

How the chain worked

OpenAI's community forum runs Discourse, a widely used discussion platform. Discourse passed uploaded images to ImageMagick, which in turn called libheif. On the server in question, running Debian 12, libheif was missing a security backport. A crafted image was therefore enough to run code on the forum.

The second step is the part that turned a forum bug into a company problem. The forum used OpenAI's own identity system for login, so a session there carried weight elsewhere. "Any user or OpenAI employee logging into OpenAI's own help forum (community.openai.com) could have had their ChatGPT and Codex accounts taken over," the Hacktron team wrote.

With an employee account under their control, the researchers instructed that employee's Codex agent to open a pull request in OpenAI's internal repository. That was the proof, and they stopped there. VentureBeat reported on September 17, 2026 that Hacktron drew the line clearly: "The account escalation was not a Discourse vulnerability but an OpenAI identity issue."

Timeline and payout

Event	Detail
Discovery	July 23, 2026
Report to fix confirmed	About 14 hours
Discourse flaw severity	CVSS 8.8, patched the day it was reported
OpenAI identity fix confirmed	July 25, 2026, 22:49 UTC
Bounty	$6,500, paid through Bugcrowd

Attacks against Discourse itself sat outside OpenAI's bug bounty scope. The payment covered the identity finding, which was the one that crossed into OpenAI's own systems.

The AI angle, stated carefully

Hacktron says the exploit work was done with Anthropic's Claude Opus 5, released on July 24, 2026, and that an earlier model had struggled with the same task. The team put its total token spend under $3,000. "Work that once required a well-resourced team and months of effort can now be compressed into days," the write-up says.

That claim deserves the caveat the researchers themselves imply. A model shortened the exploit-writing step. Finding an unpatched library on a forum, and noticing that the forum shared an identity provider with production accounts, is reconnaissance and judgment. Tech AI Wire has covered adjacent cases before, including OpenAI agents attacking RubyGems in an undisclosed test.

What this means for developers

Audit your trust boundaries before your dependencies. The question to ask is simple: if someone takes over an account on your least important property, what else does that account open? A community forum, a status page, or a swag store should not share a login path with production. If it does, the forum inherits production's blast radius.

Then check the version, not the package name. The libheif bug was already known and fixed upstream; the exposure came from a distribution image that had not picked up the backport. Anything that decodes untrusted media on your servers belongs on an inventory with a patch owner, and image processing in particular should run sandboxed or in a separate service.

Finally, treat agent credentials as production credentials. An assistant with repository write access is an account that can commit code, so it deserves the same review, scoping, and revocation path as a human engineer's token. This story ends in a pull request precisely because the agent could open one.