On July 25, 2026, a security team chained two critical vulnerabilities to compromise multiple OpenAI employees’ ChatGPT and Codex accounts, enabling access to internal repositories via the internal monorepo openai/openai. The exploit began with an SSO misconfiguration in OpenAI’s identity infrastructure and a heap buffer overflow in libheif, exploited through image uploads on community.openai.com, which uses Discourse. Since users could connect services like GitHub, Slack, and email to Codex and ChatGPT, the potential access scope was significant.

The team gained access in under 72 hours, reported the flaws to OpenAI and Discourse, and coordinated a patch. OpenAI awarded a $6,500 bounty. The vulnerability affected any self-hosted Discourse instance using outdated Docker images with vulnerable libheif; users were advised to rebuild via git pull and ./launcher rebuild app.

The researchers, from Hacktron and led by Harsh Jaiswal with Mohan Pedhapati and Rahul Maini, later expanded findings into HEIF Heist, tracing libheif’s widespread use across frameworks like Next.js, Astro, and Gatsby. They warned that any application processing .heic/.heif/.avif images is likely affected and offered assistance via [email protected].