At a high level, this was the full exploit chain.

1. HEIC/HEIF upload
2. ImageMagick decoding
3. Heap overflow on libheif
4. RCE on community.openai.com
5. Critical OpenAI SSO flaw
6. ChatGPT/Codex takeover
7. Connected GitHub access
8. Internal repo PR #1186742

The image package libheif had a known vulnerability, fixed upstream, but the fix never flagged as security-relevant and was still present in Discourse. Uploading a HEIF file gave us RCE on the OpenAI forum community.openai.com.

github.com/strukturag/lib…

The second bug is more serious: an OpenAI SSO vulnerability.

Using this flaw, we turned our Discourse forum exploit into access to ChatGPT and Codex accounts belonging to people who had signed into it, including OpenAI employees.

Those accounts could be (and some were) connected to Outlook, Gmail, Google Drive, Slack, GitHub, and other services via Codex or ChatGPT. This made the potential impact much larger than ChatGPT alone.

To demonstrate impact while minimising exposure, we used one affected employee account connected to OpenAI’s GitHub org.

Codex created a harmless PR in their internal monorepo without us reading sensitive code. That proved to us that the access was real.

We reported the bug to Discourse and OpenAI. OpenAI fixed the SSO issue roughly 14 hours after our initial submission.

Discourse received our separate report Saturday, replied Sunday, and had a fix Monday.

OpenAI awarded us $6,500.

AI agents did a meaningful share of the exploit work.

Opus 4.8 found the libheif vulnerability and built a partial exploit. Hours after Opus 5 launched, it adapted the exploit to Discourse and achieved RCE on our test instance.

Our main takeaway from hacking OpenAI: AI is reducing the amount of scarce expertise needed to develop exploits. Work that once took months can now take days.

Even leading AI labs can be vulnerable.

Defenders need to fix the architecture, patch faster, and limit the blast radius of connected things.

This work was done by our team @HacktronAI led by @rootxharsh along with me and @iamnoooob.

We have published the full details of the exploit chain, as well as how we discovered it, on our blog here:

hacktron.ai/blog/hacking-o…

also we are not some random dudes, check our work before, we work with companies like perplexity and vercel.

hacktron.ai/blog/