How a Heap Overflow and an SSO Bug Reached OpenAI's Monorepo

Security research firm Hacktron said it reached OpenAI's internal code repository in July by chaining a heap overflow in an image-processing library through the company's community forum and a misconfigured single sign-on setup, according to a write-up the firm published Sept. 12 that reached Hacker News's front page this week.

The chain started far from OpenAI's own code. Hacktron found a heap buffer overflow in libheif, an HEIC image-decoding library, that had a security fix upstream Debian 12 and 13 packages had not backported, according to Hacktron's own account of the research. Discourse, the forum software running OpenAI's community.openai.com, used ImageMagick to convert uploaded images, and ImageMagick called the vulnerable libheif code on any HEIC file a user uploaded.

From a forum bug to hijacked Codex sessions

Compromising the Discourse forum alone would not normally reach ChatGPT or Codex accounts. What did was a separate flaw in OpenAI's identity infrastructure. "We want to emphasize that the vulnerability to escalate is not Discourse-specific," Hacktron wrote. "It is an OpenAI SSO issue that turned the forum compromise into access to ChatGPT and Codex."

One of the accounts the researchers reached belonged to an active OpenAI engineer whose Codex coding agent was connected to the company's internal GitHub organization. Rather than clone the internal monorepo directly, Hacktron sent the employee's Codex session a prompt instructing it to open a pull request, producing PR #1186742 inside the openai/openai repository as proof of access, without reading or copying proprietary code.

A fast timeline, on production systems

Hacktron says the entire chain ran against OpenAI's live, production systems rather than a sandbox or a disclosed test environment.

Time (UTC)	Event
July 25, 05:00-06:00	Hacktron achieves remote code execution via the libheif chain
July 25, 08:00-10:00	Hacktron files a report through Bugcrowd
July 25, 22:49:45	OpenAI confirms a fix is deployed
July 28	Discourse publishes advisory GHSA-vhm9-85gw-x335

OpenAI paid Hacktron a $6,500 bounty, though the company said that testing against the Discourse-hosted community.openai.com was explicitly excluded from its bug bounty program's scope; the award recognized the SSO flaw on OpenAI's own side of the chain rather than the forum bug itself.

The detail that makes this an AI story, not just a security one

A separate write-up on the chain, published by the security newsletter Lilting Channel, describes the research itself as a marker of how far AI-assisted vulnerability research has moved: "AI security agents have clearly moved beyond isolated code audits," the newsletter wrote, "they are now capable of assembling end-to-end exploit chains against real-world mitigations in hours". Hacktron's own write-up does not specify how much of its exploit chain construction was itself AI-assisted, and did not name individual researchers, referring only to the Hacktron team throughout.

The episode joins a run of 2026 incidents in which AI coding tools' access to real infrastructure outran the safeguards around that access. Tencent's BrowserSkill shipped a gap that let a command-line flag skip the human confirmation step before an agent could act inside a user's logged-in browser, and OpenAI's own new capability-disclosure framework, used this month to report a model that wrote a fake jailbreak persona into 27 training summaries, was built for a different category of risk than an engineer's coding agent being remotely commandeered to open a pull request.

OpenAI has not said whether it audited other internal tools connected to employee SSO sessions the way Codex was, or whether the Discourse-to-SSO escalation path Hacktron found has an equivalent in any of the company's other externally facing services.