Two Chained Vulnerabilities Exposed OpenAI ChatGPT and Codex Accounts Through a Community Forum
A new level of defensive visibility into AI-assisted exploitation arrived on July 25, 2026, when two chained vulnerabilities, a heap buffer overflow in the libheif image decoder and a single sign-on flaw in OpenAI’s identity flow, were combined to take over employee ChatGPT and Codex accounts through OpenAI’s own community forum. From initial finding to internal repository access, the entire exploit chain played out in under 72 hours, ending with a proof-of-concept pull request opened by a compromised Codex account inside the OpenAI monorepo and a $6,500 bug bounty paid by OpenAI.
What the exploit chain actually looked like
The first link was a memory-safety bug inside libheif, the open-source HEIC/HEIF image decoder that ships inside ImageMagick. When a user uploaded an HEIC or HEIF file to the Discourse forum at community.openai.com, the file skipped FastImage (which did not support the format) and was handed straight to ImageMagick’s magick command, exposing the underlying libheif parser to attacker-controlled bytes.
The vulnerable code path was traced to a commit that had landed in libheif the previous year. Although it was a meaningful rewrite, it was never flagged as a security fix and received no CVE. As a result, neither Debian 12 nor Debian 13 carried the necessary backport at the time. The Discourse Docker image, based on Debian 12, installed libheif 1.19.7, while Debian 13 still shipped 1.19.8. Debian eventually published its security update, DSA-6417-1, on August 8, 2026.
The second link was an SSO misconfiguration in OpenAI’s identity infrastructure. The forum allowed Sign in with OpenAI through auth.openai.com, and that identity flow did not require any further interaction after the forum account was already active. In other words, anyone who could run code on the forum could mint a session as any active forum member, including OpenAI staff, and walk straight into ChatGPT and Codex without any prompt or approval.
That combination, remote code execution on the forum and a trust shortcut from the forum into OpenAI accounts, was what made the chain dangerous. Discourse itself was a hardened target, but its third-party image-processing dependency and OpenAI’s identity trust shortcut turned a forum compromise into access to internal OpenAI services, including the GitHub organization the compromised Codex was connected to.
The 72-hour timeline
The research session began on July 23 with a review of Discourse’s image-upload pipeline. By the morning of July 25, working code execution had been confirmed against a local Discourse Docker image and then escalated against Discourse Cloud, with the agent reading /etc/hosts on the target instance as proof. From there, the same exploit script was used against OpenAI’s own forum, and a Codex account belonging to an OpenAI employee was used to open a harmless pull request in the internal openai/openai monorepo. All further testing stopped at approximately 15:30 UTC.
The disclosure moved fast on both sides. OpenAI confirmed the fix roughly 14 hours after the initial Bugcrowd submission. Discourse received the report on a Saturday, replied on Sunday, and had a patch ready by Monday, going further to sandbox ImageMagick as defense in depth. The Discourse advisory, GHSA-vhm9-85gw-x335, was published on July 28, and OpenAI marked the report resolved and paid the $6,500 bounty on September 1.
OpenAI’s bounty comment clarified one important boundary: testing against the Discourse-hosted community.openai.com was explicitly excluded from OpenAI’s bug bounty program. The award recognized the OpenAI-side finding, not the actions taken against Discourse itself.
How AI tools accelerated the work
The research was driven by a mix of AI-assisted exploitation and human direction. A session running on Anthropic’s Claude Opus 4.8 spent several attempts trying to land a reliable exploit with ASLR enabled and failed. On the evening of July 24, Anthropic released Claude Opus 5. A fresh session produced a working ARM64 exploit on a local Mac within three hours, then ported it to the x86-64 environment and jemalloc configuration that Discourse uses. By 6:00 a.m. UTC on July 25, local RCE through an image upload was confirmed. The agent was then placed in an autonomous goal loop against a self-hosted Discourse Cloud instance and reached RCE there within a few hours.
The broader campaign, branded HEIF Heist, reused the same exploit pattern against Slack, Meta, GitHub Enterprise, Ruby on Rails, and Node.js frameworks such as Next.js, Astro, and Gatsby. Across two months of work by three researchers, the total token spend stayed under $3,000, and adapting the exploit to each new target usually took one to two days. In several cases, the AI began almost blind, without knowing the exact libheif version, libc version, or deployment environment, and still produced a working memory leak or shell. Only Shopify was observed to detect the activity, even after thousands of probe images caused repeated image-processor crashes.
Why this matters beyond one forum compromise
The single most important point is that the privilege-escalation step was not specific to Discourse. The flaw was in OpenAI’s SSO, and any first-party or third-party OpenAI service that authenticated through it could have been used the same way. Discourse was simply the proof-of-concept path. The implication is broader than one forum: any organization that delegates authentication to a third party and then trusts that third party’s sessions inherits the third party’s vulnerabilities.
There is also a wider pattern. Memory corruption has historically been expensive to weaponize, which gave ordinary companies a kind of practical protection even when the bugs themselves were public. AI-assisted exploitation is collapsing that cost. The HEIF Heist research converted a publicly known but hard-to-exploit library bug into reliable remote code execution across multiple major products with days of work, not months, and the cost in tokens, not in person-years of reverse engineering.
What affected operators should do
Self-hosted Discourse operators need to rebuild their installation rather than rely on a web-interface update. Running git pull followed by ./launcher rebuild app from /var/discourse replaces the underlying image layers; an in-place web upgrade may not. Discourse-hosted customers have already been patched.
For any deployment that processes user-controlled images and accepts .heic, .heif, or .avif files, the latest upstream security release as of September 14, 2026 is libheif v1.23.4. v1.23.2 has been superseded. Distribution packages may carry backported fixes under older version numbers, so the package security advisory should be checked directly. Because the ISO base media file format is complex and decoder bugs keep appearing, production systems should consider disabling untrusted HEIF and AVIF decoding where it is not needed, or isolating the image-processing pipeline inside a hardened, ephemeral sandbox. ImageMagick’s security policy supports restricting accepted formats and resource limits and is a useful starting point for that isolation.
Image-processing is a quiet dependency that sits behind forums, comment systems, profile pictures, document previews, and media uploads. Any place that accepts files from outside the trust boundary and routes them through a native decoder is part of the same attack surface. Ranks on a local search grid can shift quickly when a forum or help center is taken offline for patching, and a tool like SEOScanPro‘s GEO Grids is the right way to see that kind of service-area visibility move as it happens.
FAQ
What vulnerabilities were used to compromise OpenAI employee accounts?
A heap buffer overflow in the libheif image decoder (the same library used inside ImageMagick for HEIC and HEIF files) combined with an SSO misconfiguration in OpenAI’s identity flow that trusted Discourse forum sessions. Together they allowed code execution on the forum and a non-interactive takeover of any active forum member’s ChatGPT and Codex account.
How long did the OpenAI account takeover take?
From the initial finding on July 23 to a proof-of-concept pull request opened in the OpenAI monorepo on July 25, the full exploit chain played out in under 72 hours, with the disclosure to OpenAI completed the same day.
What should self-hosted Discourse operators do?
Rebuild the Docker image rather than rely on a web update. From /var/discourse, run git pull followed by ./launcher rebuild app. Discourse-hosted customers have already been patched, and the advisory GHSA-vhm9-85gw-x335 contains the full patch and rebuild guidance.
BizScoreAI
BizScoreAI scores how visible a business is to AI search and shows what its listing looks like to the engines people ask. Open the AI visibility scan.