Hacktron Chained a libheif Overflow and an SSO Flaw to Reach OpenAI's Monorepo

An attacker who could upload an image to OpenAI's community forum could reach remote code execution on the Discourse host, then use a single sign-on weakness to take over ChatGPT and Codex accounts of people who had logged in there. Hacktron researchers did exactly that on July 25, 2026, and OpenAI announced on November 6 that Hacktron will now test its systems under a formal partnership.

The flaw is a heap buffer overflow in libheif, the HEIF image library, reached because Discourse hands HEIC files to ImageMagick when its default image checker, FastImage, cannot read them. Hacktron says the upstream fix "received no CVE."

The chain, step by step

Hacktron's technical write-up gives a UTC timeline. On July 23 the team traced the HEIF path to libheif 1.19.7, the version in Discourse's Docker image on Debian 12. On July 24 Claude Opus 4.8 produced a working exploit with address randomisation disabled. Claude Opus 5 was released that evening, and by about 06:00 on July 25 it produced a reliable exploit with randomisation on.

Time on July 25 (UTC)	Event
05:00 to 06:00	Code execution and admin access on the Discourse environment
08:00 to 10:00	Report submitted to OpenAI through Bugcrowd
10:00	Exploit works against community.openai.com
13:30 to 15:30	Codex account of an OpenAI employee used to open a harmless pull request
22:49	OpenAI confirms its fix

The employee's Codex account was connected to OpenAI's GitHub organization, and the harmless pull request landed in its internal monorepo, after which testing stopped. Hacktron describes the second flaw only as "an OpenAI SSO issue" and a misconfiguration in identity infrastructure, and gives no mechanism. That is the part of the chain a reader cannot reproduce.

What OpenAI paid for, and what it did not

OpenAI marked the report resolved on September 1 and paid $6,500. The Register reports that OpenAI said testing against the Discourse-hosted forum was explicitly out of scope, and that the award covers the OpenAI-side finding, not the actions against Discourse. Hacktron's post quotes the same distinction.

OpenAI confirmed its fix about 14 hours after the report. Neither OpenAI nor Anthropic responded to The Register's requests for comment, according to that outlet.

The Discourse and libheif side

Hacktron reported to Discourse through HackerOne on July 25. Discourse published advisory GHSA-vhm9-85gw-x335 on July 28 and added ImageMagick sandboxing. Debian issued DSA-6417-1 on August 8, and Hacktron lists upstream libheif v1.23.4 as the latest security release as of September 14.

Affected families named in the write-up are 1.19.x, 1.20.x, 1.22.x and 1.23.x, and Debian 13 still shipped 1.19.8 when the post was written. Anyone running self-hosted Discourse or any service that converts HEIC through ImageMagick should check the installed libheif build against the Debian advisory.

The partnership, and what it does not say

The November 6 announcement says Hacktron researchers will work with OpenAI engineers on testing the connections to third-party services, and that Hacktron gets wider access to frontier models through Daybreak Red, OpenAI's tier for governed red teaming. Hacktron chief executive Zayne Zhang wrote that "The future of cybersecurity won't be defined by who has the largest security team."

The announcement names no vulnerabilities and no fee. Nothing in either source says anyone exploited the July flaws before the researchers did. This compares with the Ivanti Connect Secure chain, where exploitation preceded the patch; here the order was the reverse.

The open items are the SSO mechanism and the scope of the new engagement. Hacktron's own post is the place to watch, and the OpenSSH 10.6p2 bypass is a reminder that a patched library is not a patched deployment.