Security researchers successfully exploited vulnerabilities in OpenAI's systems, gaining access to employee ChatGPT accounts and demonstrating potential reach into an internal OpenAI code repository. The exploit chain, which took less than 72 hours from discovery to proof of concept, earned the researchers a $6,500 bounty from OpenAI.
The team, identified as Hacktron researchers Harsh Jaiswal, Mohan Pedhapati, and Rahul Maini, initiated their attack on July 25 through OpenAI's community forum, community.openai.com. This forum operates on Discourse, which typically uses FastImage for image validation. However, due to a lack of HEIF file support in FastImage within the specific setup, HEIF images uploaded to Discourse were processed by ImageMagick, which in turn utilized libheif before converting them to another format. This exposed the underlying libheif parser to attacker-controlled files.
Leveraging Anthropic's Claude Opus 4.8, the researchers identified a heap buffer overflow flaw within the libheif library. Their initial attempts to develop a remote code execution (RCE) attack using this model were unsuccessful against Discourse's default configuration. However, with the subsequent release of Claude Opus 5, the researchers were able to generate an exploit script that achieved RCE on OpenAI's Discourse instance.
Following this initial breach, the researchers immediately reported the vulnerability to OpenAI. They then proceeded to take over an OpenAI employee's account, which had its Codex service connected to OpenAI's GitHub organization. To demonstrate impact without accessing sensitive code, they used the employee's Codex account to open a pull request in OpenAI's internal monorepo, then ceased further testing.
OpenAI confirmed the fix for the vulnerability within approximately 14 hours of the report's submission. The company clarified that the $6,500 bounty specifically recognized the OpenAI-side finding, not actions against the Discourse platform, as testing against community.openai.com was explicitly excluded from their bug bounty program. Discourse also issued a fix, incorporating image-processing sandboxing, and published a security advisory (GHSA-vhm9-85gw-x335) with patching and rebuild guidance.
The researchers highlighted the speed and efficiency of the operation, noting that the entire hack involved only a few hours of human effort alongside the AI agent's work. They emphasized that security assumptions need to evolve to match the capabilities of modern attackers, as tasks that once required extensive resources and months of effort can now be completed in days.
