Hacktron's July research chained two distinct boundaries. The first was software exploitation: Discourse's HEIF upload path exposed a vulnerable libheif parser through ImageMagick, and the researchers used Claude Opus 4.8 and then Opus 5 to help turn the memory-corruption bug into reliable code execution. The second was identity: after obtaining…
Inspect the ClaimsCase · DiggingBeagle record
Hacktron: image processing, SSO and connected development authority
Hacktron describes a July 2026 defensive-research chain that began with a missing libheif security backport, reached remote code execution in an OpenAI-hosted Discourse forum, crossed an OpenAI SSO boundary, and was demonstrated by asking Codex to open a harmless pull request in an internal repository. The researchers say Claude Opus 4.8 and Opus 5 materially accelerated exploit development, but skilled human guidance remained important and the broader connected-app reach was not demonstrated.
Assessment profile
Assessment method- Setting
- controlled live
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- fixed reported
- AI role
- WITH AI
Basis and provenance
The disclosed live account/harmless-PR proof is research activity; additional connectors and code-reading were not demonstrated. The account path fix and Discourse advisory are reported remediation, not a new independent retest. Assessment is a desk review of the retained canonical Claims and cited Source metadata at their recorded cutoff, not a new external verification. Impact remains ungraded.
Assessed Sep 24, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-RESEARCH-01 · CLM-HACKTRON-PR-LIMIT · CLM-HACKTRON-REMEDIATION · CLM-RESEARCH-04 · RCE via malformed HEIF file · Hacking OpenAI
At a glance
Connected-account authority should be reviewed as a chain. Image-processing, SSO and developer integrations can turn a narrow foothold into wider effective authority even when the model itself is not the security boundary.
Read the implicationsBroader unauthorized exploitation or customer loss is not established. A later bounty award does not establish authorization for every earlier forum action.
Limits and uncertaintyFull account
Hacktron's July research chained two distinct boundaries. The first was software exploitation: Discourse's HEIF upload path exposed a vulnerable libheif parser through ImageMagick, and the researchers used Claude Opus 4.8 and then Opus 5 to help turn the memory-corruption bug into reliable code execution. The second was identity: after obtaining administrative access to OpenAI's community forum, the researchers used an OpenAI SSO flaw to reach employee ChatGPT and Codex accounts.
The demonstrated impact stopped short of reading internal source. To prove the authority they had reached, the researchers used an employee Codex session connected to OpenAI's GitHub organization to create a harmless pull request in an internal monorepo, then stopped testing. The disclosure discusses potentially reachable services such as other connectors, but does not establish that they were accessed. Hacktron describes AI as a major accelerator for exploit development while also stating that skilled human guidance remained important and the work was not completely autonomous.
Mechanism and trust boundary
- 01
Reach the HEIF image-decoding path
Discourse passes HEIF/HEIC uploads through ImageMagick into libheif, exposing attacker-controlled image data to the decoder.
Boundary: untrusted image upload / native parser
- 02
Exploit the missing libheif security backport
A heap-buffer-overflow condition is developed into reliable code execution with AI-assisted exploit work.
Boundary: memory corruption / process execution
- 03
Compromise the OpenAI-hosted Discourse forum
The researchers obtain RCE and administrative access to community.openai.com.
Boundary: forum host / application administration
- 04
Cross the OpenAI SSO boundary
The forum foothold is chained with an identity flaw that enables takeover of OpenAI employee ChatGPT/Codex accounts.
Boundary: forum identity / OpenAI account identity
- 05
Inherit connected Codex authority
A compromised employee account has Codex connected to OpenAI's GitHub organization.
Boundary: account session / connected developer service
- 06
Demonstrate access with a harmless internal pull request
Codex is asked to open a proof-of-access PR without the researchers reading internal source code.
Boundary: connected service / internal repository write
- 07
Stop before testing broader connectors
The disclosure describes wider potential reach but does not establish access to every connected application.
Boundary: demonstrated authority / theoretical downstream reach
Timeline
- Jul 23, 2026discovery
Researchers begin reviewing Discourse's HEIF upload path
The team identifies the libheif exposure and missing security-relevant backports.
- Jul 24, 2026Event type unspecified
Opus 4.8 helps develop a working local exploit
The team obtains code execution with ASLR disabled but initially struggles to make the exploit reliable against the default environment.
- Jul 25, 2026discovery
Reliable RCE and forum administration obtained
By early July 25 the researchers confirm image-upload RCE, then achieve RCE on a researcher-controlled Discourse Cloud target and OpenAI's forum.
- Jul 25, 2026Event type unspecified
OpenAI account authority demonstrated and testing stopped
The researchers reach an employee ChatGPT/Codex account and use Codex to create a harmless internal pull request, then cease further testing.
- Jul 25, 2026mitigation
OpenAI confirms its account-takeover path is fixed
Hacktron records OpenAI confirmation at 22:49 UTC, roughly fourteen hours after the initial bounty submission.
- Jul 27, 2026mitigation
Discourse has a fix ready
Discourse also adds image-processing sandboxing as defense in depth.
- Jul 28, 2026Event type unspecified
Discourse publishes GHSA-vhm9-85gw-x335
The maintainer advisory provides patch and rebuild guidance for the malformed-HEIF RCE path.
- Sep 1, 2026correction
OpenAI marks the bounty report resolved
OpenAI awards $6,500 for the OpenAI-side finding while clarifying that testing the Discourse-hosted forum was outside its bounty scope.
- Sep 13, 2026Event type unspecified
Hacktron publishes the full technical disclosure
The public write-up documents the exploit-development process, SSO chain, proof of access and authorization caveats.
Claims & evidence
CLM-RESEARCH-01Hacktron reports a July 25 chain from Discourse image processing through an OpenAI SSO flaw into employee ChatGPT/Codex accounts, demonstrated with a harmless internal pull request.supported
Basis: reported finding
- supportsHacking OpenAIprimary technical disclosure
Intro; disclosure timeline; Opus 5 Released
CLM-RESEARCH-02The authors identify Opus 4.8 and Opus 5. They say they did not read internal code; access to other connectors was potential rather than demonstrated.supported
Basis: reported finding
- supportsHacking OpenAIprimary technical disclosure
Background; Opus 5 Released
CLM-RESEARCH-03The sub-$3,000 token figure covers broader multi-company research. The $6,500 award covered the OpenAI-side finding; the quoted scope clarification excludes testing the Discourse-hosted forum from that bounty.supported
Basis: reported finding
- supportsHacking OpenAIprimary technical disclosure
Costs of finding these vulnerabilities; disclosure timeline item 9
CLM-RESEARCH-04Discourse advisory GHSA-vhm9-85gw-x335 associates CVE-2026-32882 with the HEIF processing flaw and supplies patch/rebuild guidance.supported
Basis: reported finding
- supportsRCE via malformed HEIF filevendor security advisory
Advisory impact, CVE and patches
CLM-HACKTRON-PR-LIMITThe researchers demonstrated internal development authority by having Codex open a harmless pull request, while stating that they did not read internal OpenAI source code.supported
Basis: reported finding
- supportsHacking OpenAIprimary technical disclosure
OpenAI employee account/Codex proof-of-access section
CLM-HACKTRON-REMEDIATIONOpenAI fixed the account-takeover path on July 25, and Discourse subsequently published a HEIF advisory and image-processing mitigations.supported
Basis: reported finding
- supportsHacking OpenAIprimary technical disclosure
timeline; OpenAI fix confirmation
CLM-HACKTRON-HUMAN-GUIDANCEHacktron says Claude materially accelerated exploit development, including an autonomous loop against a researcher-controlled Discourse instance, but skilled human guidance remained important and the work was not completely autonomous.supported
Basis: reported finding
- supportsHacking OpenAIprimary technical disclosure
sections describing Opus 4.8/Opus 5 exploit development and the /goal loop
CLM-HACKTRON-BROADER-REACH-LIMITThe disclosure discusses broader potential access through connected services, but it does not establish that those additional services were actually accessed.supported
Basis: reported finding
- supportsHacking OpenAIprimary technical disclosure
discussion of connected applications and stated stopping point
Implications
Connected-account authority should be reviewed as a chain. Image-processing, SSO and developer integrations can turn a narrow foothold into wider effective authority even when the model itself is not the security boundary.
Controls and mitigations
- OpenAI fixed the SSO account-takeover path on July 25.
- Discourse rebuilt/patched the affected image-processing stack and documented image sandboxing.
- Operators using vulnerable HEIF/AVIF processing should update the relevant dependency chain or disable/sandbox untrusted HEIF/AVIF processing where updating is not immediately possible.
Unknowns and contradictions
- Broader unauthorized exploitation or customer loss is not established.
- A later bounty award does not establish authorization for every earlier forum action.
Sources and citation
Material revision history
- Sep 18, 2026 · Published version · first publication · revision 12
- Sep 19, 2026 · Published version · material revision · revision 17Public fields changed: attack_path, narrative, timeline
- Oct 6, 2026 · Published version · material revision · revision 38Public fields changed: assessment_profile