Three researchers from Hacktron successfully exploited a vulnerability in the Discourse forum used by OpenAI, gaining unauthorized access to staff accounts for ChatGPT and Codex. The attack, which took less than 72 hours from initial discovery to accessing an internal OpenAI code repository, highlighted risks associated with shared single sign-on (SSO) systems.
The method of attack did not involve phishing or stolen passwords. Instead, it leveraged a heap buffer overflow vulnerability within the `libheif` library, which Discourse uses to process HEIC and HEIF image uploads via ImageMagick. This memory corruption flaw allowed attackers to read or write data outside of intended memory regions. While the vulnerability had been fixed upstream in `libheif` the previous year, the patch lacked a CVE identifier and had not been backported to Debian, which Discourse utilized.
A notable aspect of the exploit development was the role of artificial intelligence. Initially, the researchers tasked Claude Opus 4.8 with creating an exploit, but it struggled with protections like Address Space Layout Randomization (ASLR). Upon the release of Anthropic's Opus 5, the same task was given to the new model, which successfully generated a working exploit against a local Mac system in just three hours. The researchers observed further improvements with GPT-5.6 Sol, which could exploit the vulnerability without prior knowledge of the target system.
After developing the exploit, the researchers adapted it to Discourse's server environment, which ran x86-64 with jemalloc. They achieved local code execution and then, using their cloud instance disguised as a capture-the-flag target to bypass Opus 5's refusal to attack live systems, gained root-level access. They confirmed this by reading the `/etc/hosts` file.
The same exploit was then used against OpenAI's Discourse instance. To demonstrate account takeover without causing harm, the researchers utilized a hijacked employee's Codex account to create a single, harmless pull request within an internal OpenAI code repository. No source code was accessed, no merges were performed, and no changes were shipped.
Following the demonstration, the researchers reported their findings to both OpenAI and Discourse. OpenAI confirmed a fix approximately 14 hours after the initial report and awarded a $6,500 bounty. OpenAI clarified that the bounty specifically recognized the "OpenAI-side finding" and not actions against the Discourse-hosted community forum, as testing against that platform was outside their bug bounty program's scope. Discourse, for its part, released a patch the following Monday and implemented additional sandboxing for its image processing to enhance security.
The Hacktron team emphasized that the underlying vulnerability allowing escalation was not specific to Discourse but rather an issue with OpenAI's SSO architecture. They stated that any first-party or third-party OpenAI service using the OpenAI SSO, if compromised, could lead to similar access. This points to an identity architecture problem rather than solely a forum or image library flaw.
This incident is part of a broader research initiative by Hacktron called "HEIF Heist," which has spent two months investigating the same `libheif` issue across various companies and frameworks, including Slack, Meta, GitHub Enterprise, and Next.js. The total cost for AI usage across three researchers for this extensive campaign was less than $3,000, illustrating a significant shift in the cost and accessibility of exploiting memory corruption bugs. Organizations are advised to verify the `libheif` version running if their products accept HEIC, HEIF, or AVIF uploads and to re-evaluate shared login systems between public-facing services and critical internal infrastructure.
