Hacktron’s OpenAI Hack: Heap Overflow and SSO Misconfiguration Lead to Internal Repo Compromise

Takeaway

Hacktron combined a heap‑buffer overflow in the libheif image decoder with a misconfigured OpenAI SSO flow to hijack employee ChatGPT/Codex accounts, gain GitHub integration, and open a pull request in OpenAI’s internal monorepo – all within 72 hours and with only a few hours of human effort.

Exploit Chain Overview

The attack proceeded through a nine‑step chain:

  1. libheif image decoder contained an out‑of‑bounds read/write primitive.
  2. Debian’s missing security backport left vulnerable libheif versions (1.19.7/1.19.8) in the Discourse Docker image.
  3. ImageMagick invoked libheif for HEIC/HEIF uploads.
  4. OpenAI’s public forum (community.openai.com) runs Discourse.
  5. OpenAI SSO (auth.openai.com) linked forum logins to ChatGPT/Codex accounts.
  6. Compromised forum accounts yielded control of employee ChatGPT/Codex sessions.
  7. Codex integration with GitHub allowed repository access.
  8. Hackers opened PR #1186742 in the internal openai/openai monorepo as proof of concept.
  9. The chain demonstrated that any service using OpenAI SSO could be leveraged similarly.

Vulnerability Details

Heap overflow in libheif

  • Discourse forwards HEIC/HEIF files to ImageMagick because FastImage lacks HEIF support.
  • The upstream libheif commit that introduced the overflow was not tagged as a security fix and received no CVE, so Debian 12/13 shipped vulnerable 1.19.x packages.
  • The overflow enables arbitrary out‑of‑bounds read/write during image decoding, providing a classic RCE primitive.

OpenAI SSO misconfiguration

  • OpenAI’s forum allowed “Sign in with OpenAI” via auth.openai.com.
  • The SSO flow did not sufficiently isolate authentication tokens, allowing a compromised forum session to hijack the linked ChatGPT/Codex account.
  • Once an employee’s Codex session was seized, the attacker could invoke any GitHub‑connected integration the employee had authorized.

Attack Execution Timeline

Time (UTC) Milestone
July 23 Discovered the libheif overflow in Discourse’s Docker image.
July 24 Developed a local exploit with Claude Opus 4.8; struggled with ASLR.
July 25 06:00 Claude Opus 5 generated a working ARM64 exploit, then ported to x86‑64 with jemalloc.
July 25 10:00 Autonomous Claude loop achieved RCE on Discourse Cloud, read /etc/hosts, and used the generated script to gain RCE on OpenAI’s forum instance.
July 25 ≈ 12:00 Hijacked an employee’s ChatGPT/Codex session, used Codex‑GitHub integration to open PR #1186742 in the internal monorepo.
July 25 – July 27 Reported findings to OpenAI, Discourse, and Bugcrowd; received a $6,500 bounty from OpenAI.

Role of Generative AI

  • Claude Opus 4.8 required multiple sessions and manual tweaking to produce a reliable exploit.
  • Claude Opus 5 produced a functional exploit within hours, automatically adapting to the target’s jemalloc configuration.
  • The researchers note a clear capability jump from Opus 5 to GPT‑5.6‑Sol when targeting unknown environments.
  • AI assistance accelerated the exploit development from days to a few hours, while human guidance remained essential for orchestration and verification.

Community and Vendor Response

  • Discourse patched the vulnerable libheif version, sandboxed ImageMagick, and released a security advisory (GHSA‑vhm9‑85gw‑x335). The fix required rebuilding Docker images (git pull && ./launcher rebuild app).
  • OpenAI coordinated a disclosure, paid a $6,500 bounty, and updated the SSO flow (details not publicly disclosed).
  • Debian published a security update for the vulnerable libheif packages on August 8, 2026.

Commentary from Hacker News

"The speed at which Claude Opus 5 produced a working exploit shows that hacking is becoming almost entirely machine‑verifiable, allowing rapid iteration beyond traditional CTF training." – @usernomdeguerre

"Unsandboxed ImageMagick remains a security nightmare; we need safer parsers like Google/Wuffs or robust sandboxing." – @oefrha

"Self‑hosting operators must rebuild Discourse containers; otherwise the vulnerable libheif remains hidden behind a web‑interface update." – @sams99

"A $6,500 bounty for a chain that could expose an entire monorepo is absurdly low; the black‑market value would be orders of magnitude higher." – @rvz

"The SSO flaw is the real juicy part – the blog omits details, leaving readers guessing how the account takeover was achieved." – @sergiotapia

Impact Assessment

  • Scope: Any OpenAI‑SSO‑enabled service (internal tools, third‑party integrations) could be compromised via the same vector.
  • Reach: Access to GitHub, Slack, email, and other connected services amplifies the potential data exfiltration.
  • Economic Cost: The research project cost < $3,000 in token usage; the human effort was measured in hours, not weeks.
  • Strategic Implication: AI‑driven exploit generation compresses the traditional “months‑of‑work” timeline into days, lowering the barrier for sophisticated attacks.

Mitigation Recommendations

  1. Patch libheif – Upgrade to upstream v1.23.4 or later; verify that distribution packages contain the backported fixes.
  2. Sandbox Image Processing – Run ImageMagick (or any native decoder) inside a hardened sandbox (e.g., Landlock, seccomp, or separate container) and enforce strict resource limits.
  3. Restrict HEIF/AVIF – Disable acceptance of HEIF/AVIF formats unless absolutely required; prefer JPEG/PNG for web uploads.
  4. Review SSO Token Scope – Ensure SSO tokens issued for forum logins cannot be reused to access high‑privilege services such as Codex or GitHub.
  5. Continuous Dependency Monitoring – Track upstream security patches for low‑level libraries (e.g., libheif, libde265) and apply them promptly.
  6. Defense‑in‑Depth for AI‑Integrated Workflows – Isolate AI‑driven integrations (Codex, ChatGPT) from privileged internal resources; enforce least‑privilege OAuth scopes.

Broader Lessons

  • Security‑by‑Complexity Is Eroding: AI can automate the knowledge‑intensive steps of turning a memory‑corruption bug into a reliable exploit, nullifying the historical protection offered by expertise scarcity.
  • Supply‑Chain Vigilance: A single image‑decoder library used across Slack, Meta, GitHub Enterprise, and many web frameworks becomes a high‑value attack surface.
  • Economic Shift: The cost of a full exploit chain is now measured in dollars of compute, not in engineering months, demanding revised threat models.
  • Responsible Disclosure: Prompt coordination between researchers, vendors, and bounty platforms can mitigate damage, but bounty amounts should reflect the true strategic impact.

The post and comments referenced are reproduced verbatim where quoted. No additional facts were invented beyond the source material.

Sources

Related