Hacktron Chains a Forum Bug to Reach OpenAI's Private Code

An unauthenticated visitor with nothing more than a browser could have followed the same path researchers did: upload a corrupted photo to OpenAI's public support forum, and come away with a pull request inside OpenAI's internal code repository. Hacktron AI, a San Francisco security research firm, said in a report published Sept. 13 that its team reached that repository within a single day in July by chaining a decade-old class of image-decoder bug to a token-scoping flaw in OpenAI's own sign-on system.

The team was led by Harsh Jaiswal, Hacktron's co-founder and chief research officer, alongside Mohan Pedhapati and Rahul Maini. Hacktron said the chain started on community.openai.com, OpenAI's support forum, which runs the Discourse platform. Discourse hands HEIC photo uploads to ImageMagick, which in turn calls libheif, an open-source image decoder. The copy of libheif running on OpenAI's forum, version 1.19.7 on Debian 12, carried a heap buffer overflow during HEIC decoding that had never been assigned its own CVE identifier upstream.

How three days closed the gap between a photo and root access

Hacktron said it used Claude Opus 5 to defeat ASLR, a memory-randomization defense meant to make exploits harder to write, within three hours of the model's release, then had it build a working exploit for ARM64 before adapting the same exploit to x86-64. Once the researchers had remote code execution and administrative access on the forum's own server, they used OpenAI's "Sign in with OpenAI" integration to escalate a compromised forum session into full control of an employee's ChatGPT and Codex accounts, exploiting what Hacktron described as an overprivileged SSO token. From there, Codex's own GitHub integration let them open a pull request inside OpenAI's internal repository.

A one-day timeline, hour by hour

Date and time (UTC)	Event
July 23-24	Vulnerability discovery and exploit development
July 25, 05:00-06:00	Remote code execution and admin access on Discourse
July 25, 08:00-10:00	Bug report filed with Bugcrowd
July 25, 13:30-15:30	Employee account compromised; proof-of-concept pull request opened
July 25, 22:49	OpenAI confirmed a fix
July 28	Discourse published its advisory
Sept. 1	OpenAI paid a $6,500 bounty

What the $6,500 bounty actually covered

Discourse's own advisory, assigned CVE-2026-32882 and rated 8.8 out of 10 on the CVSS scale, credits Hacktron's team with the report and lists fixed versions as 2026.7.0, 2026.6.1, 2026.5.2 and 2026.1.6. Hacktron said testing against Discourse itself fell outside OpenAI's bug bounty scope, so the $6,500 payment covered only what the researchers call the OpenAI-side finding: the SSO token flaw, not the forum bug that got them there in the first place. OpenAI has not published its own account of the incident. Hacktron's report is the only public description of what OpenAI did and did not confirm, including that the pull request made only a harmless change to a README file and that no Slack messages were accessed.

The same bug reached beyond one company's forum

Any Discourse installation running an unpatched libheif could have been exploited the same way, and Hacktron said it tested the technique against more than one company's forum as part of a wider campaign. Only Shopify detected the activity, according to Hacktron's account, which does not say how many other companies were tested or whether any suffered an escalation comparable to OpenAI's. That kind of gap is what let malware sit undetected inside a wave of downloaded AI agent skills before anyone noticed, and it follows Anthropic's own disclosure that state-linked hackers used Claude to automate parts of an intrusion campaign rather than write malware from scratch. Whether Discourse's patched image-processing sandboxing closes the door for good depends on how many forums beyond OpenAI's have applied it.