Security researchers at Hacktron have disclosed a vulnerability chain that they say allowed them to compromise OpenAI employee accounts and demonstrate access to an internal repository. The incident combined remote code execution in the Discourse software behind OpenAI’s community forum with a weakness in OpenAI’s single-sign-on configuration. Hacktron says both vendors fixed the issues after coordinated reporting.
The team began examining Discourse’s image-upload path on July 23. HEIC and HEIF images followed a different route from ordinary uploads because they were passed to ImageMagick for conversion, exposing the underlying libheif parser to attacker-controlled files. Hacktron found that the libheif versions in relevant Debian-based images lacked upstream fixes and could be triggered to cause a heap-buffer overflow with out-of-bounds reads and writes.
By July 25, the researchers say they had developed a working exploit against the x86-64 environment and memory allocator used by Discourse. They tested it first on infrastructure they controlled, then used it to confirm remote code execution on the community.openai.com environment. From there, the forum’s OpenAI sign-in integration allegedly created a path to active users’ broader OpenAI accounts without further interaction.
Hacktron reports that multiple employee ChatGPT accounts were affected. Because ChatGPT and Codex can connect to other services, the potential reach included repositories, messages and email, depending on each account’s configured connections. The researchers say they avoided viewing sensitive information and demonstrated the impact through a harmless pull request in OpenAI’s internal monorepo. They then stopped testing and expanded their initial bug-bounty report.
OpenAI confirmed the issue was fixed about 14 hours after submission, according to Hacktron. The company paid a $6,500 bounty, while clarifying that testing against the Discourse-hosted forum itself was outside OpenAI’s program and that the award covered the OpenAI-side finding. Discourse separately prepared a fix, introduced image-processing sandboxing as an additional defense and published an advisory with rebuild instructions.
The account is a researcher disclosure rather than an independent forensic report, so its narrative and impact assessment should be read as Hacktron’s findings. However, the described remediation and bounty provide evidence that vendors treated the reported chain as significant.
For self-hosted Discourse operators, the disclosure emphasizes that updating only through the web interface may leave an old container image and vulnerable native library in place. Hacktron advises rebuilding the installation so the underlying dependency is replaced. Hosted Discourse customers were patched by the provider.
The episode illustrates how identity links can turn a flaw in a community service into access to more sensitive products. It also shows the risk carried by native media parsers: an apparently routine image upload can cross a trust boundary long before application-level permission checks begin.
