Hacktron published a technical disclosure describing how, on July 25, 2026, researchers chained two issues to compromise OpenAI employee ChatGPT and Codex accounts tied to community.openai.com. The first link was remote code execution on OpenAI’s Discourse-hosted community forum through an unpatched libheif heap overflow reached via HEIC/HEIF image uploads handled by ImageMagick. The second was an OpenAI-side SSO weakness: community sign-in tokens carried excessive permissions that granted full API access to associated ChatGPT and Codex accounts.
According to Hacktron, until the identity issue was fixed, any user or employee who logged into the forum could have had those accounts taken over. Because ChatGPT and Codex can connect to third-party services, the theoretical blast radius included GitHub and other integrations. To prove access without learning sensitive code, the team used a compromised employee Codex session connected to OpenAI’s GitHub organization to open a harmless pull request in an internal monorepo, then stopped testing.
Hacktron says Claude models (including Opus 4.8 and Opus 5) helped build and harden the image-decoding exploit during the research. The firm reported the account-takeover path to OpenAI through Bugcrowd and the libheif issue to Discourse through HackerOne. OpenAI confirmed a fix roughly 14 hours after the Bugcrowd report, saying it narrowed permissions on Community sign-in tokens and revoked affected tokens and sessions. Discourse issued a security advisory and added image-processing sandboxing. OpenAI paid Hacktron a $6,500 bounty for the OpenAI-side finding and clarified that testing against the Discourse-hosted forum itself was out of scope for that award.
In comments to SecurityWeek on September 18, 2026, OpenAI distinguished the Discourse image bug from its own SSO flaw and said its review found limited reads of private-repository metadata and commits before the researcher-submitted README pull request. DigiEditorial verified Hacktron’s disclosure and corroborating coverage from SecurityWeek and Business Insider. The vulnerabilities described were reported and patched; this article does not reproduce exploit steps.