In the early hours of July 25, 2026, security research team Hacktron pulled off a textbook chained intrusion: they took control of several OpenAI employees' ChatGPT accounts and, through one employee's Codex-connected GitHub integration, gained access to OpenAI's internal monorepo. To prove the breach without touching sensitive code, they had the employee's Codex open a harmless pull request (#1186742) in openai/openai, then immediately ceased all further testing. From initial discovery to internal repo access, the entire chain took less than 72 hours — and the primary weapon throughout was Anthropic's Claude.
The Exploit Chain: One HEIF Image Punches Through Nine Layers
Hacktron's official disclosure, published September 13, breaks the attack into nine steps: a libheif image decoder heap overflow → missing Debian security backport → ImageMagick calling libheif → Discourse forum image uploads → the OpenAI community forum → an OpenAI SSO identity flaw → ChatGPT/Codex account takeover → the connected GitHub integration → internal repositories.
The entry point was an unglamorous image library. Discourse normally checks uploaded images with FastImage, but FastImage does not support HEIF — so those files were handed directly to ImageMagick's magick command for conversion, exposing the underlying libheif parser to attacker-controlled files. An Opus 4.8 session inside the Discourse Docker image examined the installed libheif package and found that certain security fixes had never been backported: code changed upstream a year earlier was never documented as a security fix and received no CVE, so Debian 12 and 13 kept shipping vulnerable versions (1.19.7 and 1.19.8 respectively). The heap overflow produced out-of-bounds read/write primitives during HEIC decoding, and RCE followed.
What amplified a forum bug into account takeover was the OpenAI-side SSO misconfiguration: any user or employee logging into the community forum through auth.openai.com could have their ChatGPT and Codex accounts taken over without interaction. Hacktron stressed this was not Discourse-specific — any first-party or third-party OpenAI service using OpenAI SSO, once compromised, would lead to the same access. The forum was merely one demonstrable path.
What the AI Did at Each Step
The timeline shows the model capability boundary most clearly. On July 23 they began reviewing the image-upload pipeline. On July 24, Opus 4.8 produced a working exploit with ASLR disabled, but repeatedly failed against Discourse's default ASLR-enabled configuration. That evening, Anthropic released Claude Opus 5 — a fresh session produced a working ARM64 exploit within 3 hours, then ported it to the x86-64 and jemalloc configuration Discourse uses. By 6 a.m. on July 25 they had confirmed local RCE through an image upload; by 10 a.m. the agent had achieved RCE on their own Discourse Cloud instance and read /etc/hosts. One detail stands out: Opus refused to write exploits for remote instances, so the team proxied the target to look like a CTF challenge (rce.ee/ctf-forum) before it complied.
The cost figures deserve remembering. The Discourse-plus-OpenAI effort took the agent a few days and only a few hours of human time. Scaled across the broader "HEIF Heist" research campaign — covering Slack, Meta, GitHub Enterprise and more — the two-month project cost under $3,000 in tokens total, run by three researchers, with each new company typically falling in one to two days. They also observed clear generational jumps: Opus 4.8 stalled on ASLR, Opus 5 succeeded within hours, and GPT-5.6 Sol marked another leap — exploiting the vulnerability while knowing nothing about the target system except that it was vulnerable.
Vendor Response and the Industry's Cold Reality
The vendor responses deserve credit. OpenAI confirmed the fix roughly 14 hours after the report and paid a $6,500 bounty — while clarifying that the award covered only the OpenAI-side finding, with testing against the Discourse-hosted forum explicitly excluded from the program. Discourse received the report on a Saturday, replied Sunday, and had a fix by Monday, plus sandboxed ImageMagick as defense in depth. The more sobering fact: across the multi-target campaign, thousands of images were sent and image processors crashed repeatedly — and no company detected the activity except Shopify.
This connects directly to the "death of security through obscurity" conversation: software has long benefited from security-through-complexity — a vulnerability could be public, but turning a bug into a reliable exploit required scarce expertise, significant time, and knowledge of the target environment. AI is turning that scarce expertise into compute, compressing "a well-resourced team working for months" into days. Hacktron's conclusion: threat models must catch up with the economics of attacker capability, rather than clinging to outdated assumptions about who can mount sophisticated attacks. For self-hosted Discourse operators their advice is concrete: rebuild your instance now — older Docker images may still carry the vulnerable libheif, and a web-interface update alone may not replace the underlying image.
The takeaway for ordinary developers: the unglamorous image decoder buried in your dependency tree, and a single misconfigured trust boundary in your SSO layer, are both live attack surfaces in the AI era. Isolating image-processing pipelines in hardened sandboxes and auditing SSO trust boundaries are no longer deferrable chores.
References: Hacktron's official disclosure, Hacking OpenAI; The Guardian's coverage; Discourse advisory GHSA-vhm9-85gw-x335.