Hacktron researchers described a security chain that, on July 25, 2026, linked a flaw in the image-processing path of OpenAI's community forum to a separate flaw in OpenAI's own sign-in flow. The demonstrated result was takeover of employee ChatGPT and Codex accounts and, in one case, the ability to use a Codex account connected to the corporate GitHub organization to open a harmless pull request in an internal repository. Hacktron says it stopped testing at that point and did not read internal code.
Hacktron published its technical disclosure on September 13, and the case drew renewed coverage on September 18. It matters because it shows how two weaknesses in different layers, one in third-party software and another in identity and permissions, can combine. There is also an important scope caveat: OpenAI said, in a comment reproduced by Hacktron, that testing against the Discourse-hosted forum was explicitly excluded from its bug bounty program. The $6,500 reward recognized the OpenAI-side sign-in finding.
What happened: two flaws formed one chain
The entry point was community.openai.com, OpenAI's Discourse-based forum. According to Hacktron's disclosure, HEIC and HEIF files followed a processing path through ImageMagick and the libheif library. The version present in the Discourse environment contained a memory-safety flaw that could lead to remote code execution on the forum server.
That was the first vulnerability. By itself, it compromised the forum environment. The jump into OpenAI accounts came from a second flaw in the “Sign in with OpenAI” flow. According to SecurityWeek, sign-in tokens generated for the community forum carried excessive permissions and could grant API access to associated ChatGPT and Codex accounts. That meant compromising the authenticated forum context could expose a much more powerful session than the forum function required.
Hacktron summarizes the chain as: vulnerable image library, Discourse processing, forum control, OpenAI identity flaw, ChatGPT and Codex account access and, where authorized connectors existed, additional reach. The key point is not that a Discourse bug directly granted access to OpenAI repositories. Broader access depended on the second flaw at the identity and authorization boundary.
What access the researchers demonstrated
The researchers say they compromised multiple OpenAI employee accounts. To demonstrate impact without inspecting internal material, they selected an account whose Codex was connected to OpenAI's GitHub organization. They then instructed that Codex account to open a proof-of-concept pull request in the internal openai/openai monorepo. The disclosure identifies it as PR #1186742 and says the link was redacted at OpenAI's request.
This matters when measuring the incident. What was demonstrated was a chain capable of reaching an action inside an internal repository through an integration that was already authorized on the compromised account. The Register also reports that the group opened a harmless pull request and stopped testing after the proof of access.
What was not demonstrated
Public sources do not show that the researchers downloaded internal code, copied model weights, extracted user databases, obtained customer API keys or read third-party messages. Hacktron explicitly says it avoided accessing internal code and used the pull request only as proof of reach.
Potential access also needs to be separated from proven access. Hacktron notes that ChatGPT and Codex accounts can have connectors to GitHub, Slack and email, so the theoretical exposure radius could include those services. That does not mean all of those connectors were accessed in the OpenAI case. The access actually described in public sources is the account takeover and the pull request opened through a Codex account connected to GitHub.
Timeline of the incident and fixes
| Date and time | What happened | Editorial reading |
|---|---|---|
| July 23 to 25, 2026 | Hacktron investigated Discourse's image-processing chain and developed a code-execution proof. | The initial problem sat in the upload and image-decoding path. |
| July 25, 05:00 to 06:00 UTC | Hacktron says the team obtained remote code execution and administrative access to OpenAI's forum environment. | First stage confirmed by the research team itself. |
| July 25, 08:00 to 10:00 UTC | The group submitted a report to OpenAI's Bugcrowd program. | Coordination with OpenAI on the identity flaw began from this point. |
| July 25, 13:30 to 15:30 UTC | An employee account was used to open a harmless pull request in the internal repository; testing then stopped. | This was the proof that the sign-in flaw expanded impact beyond the forum. |
| July 25, 22:49:45 UTC | OpenAI replied that the issue on its side had been fixed, roughly 14 hours after the initial report. | The public disclosure does not specify every internal configuration change. |
| July 27 to 28 | Discourse prepared its fix, added image-processing isolation and published advisory GHSA-vhm9-85gw-x335. | The first stage of the chain gained a patch and additional defense. |
| September 1 | OpenAI marked the report resolved and paid $6,500. | The company clarified that the reward covered the OpenAI-side finding, not the testing against Discourse. |
How the fixes closed the path
At the forum layer, the Discourse security advisory rates the malformed HEIF remote-code-execution issue as High with a CVSS score of 8.8. Discourse lists 2026.7.0, 2026.6.1, 2026.5.2 and 2026.1.6 as patched versions and says the updated Docker image includes a patched libheif. Hacktron also reports that Discourse added sandboxing around image processing as defense in depth.
At the OpenAI layer, sources describe the weakness as excessive permissions on tokens used for community sign-in. OpenAI confirmed to Hacktron that the issue was fixed, but the cited public disclosure does not provide a complete specification of the configuration change. Based on the architecture described, the effective goal of the fix is to prevent a credential intended for the forum from acting as a bridge to broad ChatGPT and Codex access. That restores separation between the forum's trust boundary and the stronger trust required for higher-privilege services and connectors.
That separation is the main technical lesson. Fixing only the image parser would reduce risk in Discourse but leave the identity weakness available to any other service capable of exposing the same kind of token. Fixing only the SSO path would cut off escalation into OpenAI accounts but would not eliminate code execution on the forum. Both fixes were necessary because the two vulnerabilities belonged to different components.
What role AI played in the research
Hacktron says it used Claude models while developing the exploit for the memory-safety flaw. According to its account, Claude Opus 4.8 sessions advanced the analysis but struggled to make exploitation reliable under the default environment; after Claude Opus 5 was released, the team progressed faster. This is the researchers' own account and it does not change the nature of the vulnerabilities: the first issue was a conventional memory-safety flaw in a dependency, and the second was an identity configuration with overly broad permissions.
The relevant point for security teams is economic. AI tools can reduce the time and cost of code analysis, proof-of-concept adaptation and hypothesis testing. That increases the pressure to patch dependencies quickly, constrain token permissions and treat agent integrations as part of the security perimeter.
What the case teaches about SSO and connectors
- SSO should enforce least privilege. A token created to enter a forum should not carry permissions equivalent to more sensitive services.
- Third-party applications should not inherit excessive trust. Compromise of a forum should not automatically become compromise of ChatGPT, Codex or connected systems.
- Connectors expand blast radius. When an agent already has authorized access to GitHub, Slack or email, account takeover can reach those environments without another technical exploit.
- Media-processing dependencies are attack surface. Libraries that decode complex formats receive user-controlled files and need timely updates, isolation and execution limits.
- Bug bounty does not erase scope rules. OpenAI itself emphasized that testing against the Discourse-hosted forum was outside the formal program scope, even though the OpenAI identity flaw was rewarded.
Sources and limits of the available information
This article relies primarily on Hacktron's technical disclosure, the Discourse security advisory, reporting by SecurityWeek and The Register, plus OpenAI's coordinated vulnerability disclosure policy. Part of the chronology and technical scope comes from Hacktron's own account. OpenAI confirmed the fix and bounty in material quoted by the researchers, but did not publish there a detailed technical report of all internal remediation steps.
