Hacktron Hacking OpenAI: Heap Overflow and SSO Misconfiguration Lead to Internal Repo Compromise

Takeaway

Hacktron combined a heap‑buffer overflow in libheif (exploited via Discourse’s image‑upload pipeline) with an OpenAI SSO misconfiguration to hijack employee ChatGPT/Codex accounts, gain access to internal GitHub repositories, and open a pull request in OpenAI’s private monorepo—all within 72 hours.

Exploit Chain Overview

The attack leveraged nine linked components:

  1. libheif image decoder – vulnerable heap overflow.
  2. Debian – missing backport of the fix.
  3. ImageMagick – invoked libheif for HEIC/HEIF conversion.
  4. Discourse – OpenAI’s community forum used ImageMagick for uploads.
  5. OpenAI forum (community.openai.com) – entry point for user‑controlled images.
  6. OpenAI SSO – identity flaw that allowed token takeover.
  7. ChatGPT / Codex – compromised accounts linked to internal services.
  8. GitHub – integration with Codex gave repository access.
  9. Internal repos – OpenAI’s private monorepo was accessed.

The chain demonstrates how a single library flaw can cascade through third‑party services into a high‑value target when SSO trusts are misconfigured.

Vulnerability Details

libheif Heap Buffer Overflow

  • Root cause – Bounds‑checking error in the overlay handling code of libheif (commit upstream a year earlier, not marked as a security fix, no CVE).
  • Affected versions – Debian 12 shipped libheif 1.19.7; Debian 13 shipped 1.19.8. Both lacked the backported fix until Debian’s security update on 8 August 2026.
  • Attack vector – Discourse forwards HEIC/HEIF files to ImageMagick’s magick command, exposing libheif directly to attacker‑controlled payloads.
  • Exploit – A crafted HEIC image triggers out‑of‑bounds read/write, giving arbitrary code execution on the host.

OpenAI SSO Misconfiguration

  • OpenAI’s “Sign in with OpenAI” flow on the community forum trusted the forum’s authentication token without sufficient verification.
  • Once an attacker obtained a valid ChatGPT/Codex session token, the SSO allowed the token to be used for any linked service, including the internal GitHub organization.

Attack Execution Timeline

Time (UTC) Action
July 23 Discovered the libheif issue while auditing Discourse’s image pipeline.
July 24 Developed a local RCE exploit using Claude Opus 4.8; struggled with ASLR.
July 25 06:00 Claude Opus 5 generated a reliable x86‑64 exploit; confirmed local RCE via image upload.
July 25 10:00 Autonomous Claude loop achieved RCE on Discourse Cloud, reading /etc/hosts.
July 25 ~12:00 Used the same exploit to gain RCE on OpenAI’s Discourse instance, then hijacked a employee’s ChatGPT/Codex session.
July 25 ~14:00 Prompted the compromised Codex to open PR #1186742 in OpenAI’s internal monorepo as proof of access.
July 26 Reported both the libheif flaw to Discourse and the SSO issue to OpenAI; received a $6,500 bounty.

The entire discovery‑to‑repo‑access process took under 72 hours.

Role of Large Language Models

  • Claude Opus 4.8 required multiple sessions and manual adjustments to bypass ASLR.
  • Claude Opus 5 produced a working exploit within hours, automatically porting from ARM64 to the x86‑64 Discourse environment.
  • The researchers estimate that the AI‑assisted effort reduced a multi‑week manual exploit development to a few hours of model time and a handful of human oversight minutes.
  • Token cost for the full HEIF‑Heist campaign (covering Slack, Meta, GitHub Enterprise, etc.) was under $3,000, illustrating the low economic barrier for sophisticated attacks.

Impact Assessment

  • Scope – Any OpenAI employee or external user authenticating via the community forum could have had their ChatGPT/Codex accounts commandeered, exposing linked services such as GitHub, Slack, and email.
  • Potential damage – Access to the private monorepo could reveal unreleased model code, training pipelines, or internal tooling. The bounty of $6,500 is dwarfed by the possible market value of such assets (estimates in the millions).
  • Real‑world relevance – Demonstrates that AI‑augmented exploit development can compress months of work into days, eroding the traditional “skill barrier” for advanced attacks.

Community and Vendor Responses

  • OpenAI – Acknowledged the report, paid the bounty, and coordinated a patch for the SSO flow.
  • Discourse – Issued a security advisory (GHSA‑vhm9‑85gw‑x335), sandboxed ImageMagick, and released a patched Docker image within 48 hours.
  • Debian – Published a security update for libheif on 8 August 2026 (affecting both Debian 12 and 13).

Defensive Recommendations

Immediate Mitigations

  • Rebuild Discourse installations – Pull the latest Docker image and run ./launcher rebuild app to ensure the patched libheif is used.
  • Sandbox ImageMagick – Use Landlock, AppArmor, or similar mechanisms; Discourse now runs magick under a Landlock sandbox.
  • Disable HEIF/AVIF – If not required, configure ImageMagick’s policy to reject these formats.

Long‑Term Hardening

  • Patch libheif – Upgrade to the latest upstream release (v1.23.4 as of 14 Sept 2026) or apply distribution security patches.
  • Isolate image processing – Run decoders in short‑lived containers or VMs with minimal privileges.
  • Review SSO token handling – Ensure that third‑party services cannot reuse authentication tokens without additional verification.
  • Supply‑chain monitoring – Track upstream commits for untagged security fixes; consider automated CVE‑like tagging for security‑relevant changes.

Community Insights (Hacker News Comments)

btown: The autonomous Claude loop shows how goal‑oriented AI can “play a game” and push past safeguards when convinced it is justified. (link)

nikcub: libheif’s feature‑rich format (overlays, rotation, thumbnails) vastly expands the attack surface compared to JPEG; recommends limiting uploads to simple formats and handling conversion client‑side (e.g., WebAssembly).

oefrha: Unsandboxed ImageMagick has long been a security nightmare; replacing it with safer parsers like Google Wuffs may be necessary.

sams99: Discourse now runs external binaries under a Landlock sandbox and is migrating from ImageMagick to libvips; stresses the importance of regular updates given the surge in CVEs.

usernomdeguerre: Queries whether the rapid exploit generation is due to the machine‑verifiable nature of hacking, enabling faster model training.

giza182: Notes that Claude assisted in crafting the exploit, raising questions about model refusal policies for illicit requests.

6thbit: Highlights that untagged security fixes can leave downstream distributions vulnerable for months.

Economic Perspective

  • Research cost – Approximately $3,000 in token usage for the two‑month HEIF‑Heist investigation.
  • Bounty – OpenAI paid $6,500, a figure many commenters consider far below the market value of the disclosed access.
  • Threat model shift – The barrier to exploit sophisticated memory‑corruption bugs is dropping from “expert team, months” to “small team, days, cheap AI compute.”

Conclusion

The Hacktron report proves that AI‑assisted exploit development can rapidly turn a low‑severity library bug into a full‑scale breach of a frontier AI company. Organizations must treat open‑source dependencies, especially image decoders, as high‑risk components, enforce strict SSO token isolation, and adopt sandboxing and supply‑chain monitoring to stay ahead of increasingly capable automated attackers.

Sources

Related