"Hacking OpenAI" is a disclosure write-up published on September 13, 2026 by Hacktron AI researchers Harsh Jaiswal, Mohan Pedhapati and Rahul Maini. It recounts how the team chained two vulnerabilities on July 25, 2026 to take over multiple OpenAI employees' ChatGPT and Codex accounts and, through one employee's Codex, open a proof-of-concept pull request in OpenAI's internal monorepo. The write-up documents the exploit chain, a nine-entry disclosure timeline, the roles Anthropic's Claude Opus 4.8 and Claude Opus 5 and OpenAI's GPT-5.6 Sol played in developing the exploit, and cost figures for the wider "HEIF Heist" research campaign. It is a first-party account by the researchers who conducted the intrusion, written for a security audience.
The exploit chain
The write-up presents the intrusion as a nine-step chain: a heap buffer overflow in the libheif image decoder; a missing security backport in Debian; ImageMagick's use of libheif; Discourse image uploads; OpenAI's community forum at community.openai.com; a flaw in OpenAI's single sign-on; access to ChatGPT and Codex accounts; a connected GitHub integration; and OpenAI's internal repositories. The researchers state that the entire path from initial discovery to access to OpenAI's repositories took place in less than 72 hours, and that because users connect services such as GitHub, Slack and email to Codex and ChatGPT, "the scope of what we could theoretically access was huge."
The libheif vulnerability
On July 23, 2026 the researchers began reviewing Discourse's image-upload pipeline and found that HEIC and HEIF files followed an unusual path: Discourse normally used FastImage for image checks, but because FastImage did not support HEIF, it passed those files to ImageMagick's magick command for conversion, exposing the underlying libheif parser to attacker-controlled files. They started a Claude Opus 4.8 session with the Discourse Docker image and asked it to inspect the installed libheif package for security issues; it found that some security fixes had not been backported, allowing a heap buffer overflow with out-of-bounds read/write primitives during HEIC decoding. The vulnerable code had been changed upstream the previous year, but the commit was not documented as a security fix and received no CVE — which the write-up gives as a likely reason Debian 12 and 13 had not received the relevant backports. Because the Discourse Docker image was based on Debian 12, it installed the vulnerable libheif version 1.19.7; Debian 13 still shipped the vulnerable 1.19.8 at the time, and Debian published its security update for Debian 13 on August 8, 2026.
The OpenAI single-sign-on flaw
The second vulnerability was a flaw in OpenAI's single sign-on, reachable because OpenAI uses Discourse for its forum and allows "Sign in with OpenAI" through auth.openai.com. The researchers emphasize that this vulnerability "is not Discourse-specific": it was "an OpenAI SSO issue that turned the forum compromise into access to ChatGPT and Codex," and that a compromise of any first-party or third-party OpenAI service using OpenAI SSO would have led to the same access, "Discourse was merely one way of proofing it."
Use of AI models
The write-up presents the intrusion as evidence of increasing model capability across successive releases. On July 24, 2026 the team used Opus 4.8 to develop a working ImageMagick/libheif code-execution exploit with address-space layout randomization (ASLR) disabled, then launched several separate sessions to make it reliable against Discourse's default configuration with ASLR enabled, "which wasn't fruitful." That evening Anthropic released Claude Opus 5; a new session first produced a working ARM64 exploit for a local Mac within three hours, and the team then asked it to port the exploit to the x86-64 environment and jemalloc configuration used by Discourse.
By 6:00 a.m. on July 25 the researchers had confirmed local remote code execution through an image upload. They then placed Claude in an autonomous /goal loop against their own Discourse Cloud instance, proxied through rce.ee/ctf-forum "to make it look like a CTF target as Opus refused write exploit for remote instances." At 10:00 a.m. the agent had achieved remote code execution on Discourse Cloud and demonstrated access by reading /etc/hosts; the generated exploit script was then used to obtain remote code execution on OpenAI's instance. After confirming a no-interaction account takeover of ChatGPT and Codex accounts of active forum members, the researchers took over an employee's account whose Codex was connected to OpenAI's GitHub organization and had Codex open pull request #1186742 in OpenAI's internal openai/openai monorepo "to demonstrate impact without actually accessing any internal code," then stopped testing.
The write-up states that the broader campaign showed "another clear jump from Opus 5 to GPT-5.6 Sol" when the team had to exploit a vulnerability "without knowing anything about the target system besides that it's vulnerable." For each target, testing began with an image upload, and the model turned memory corruption into a reliable memory leak or shell, "usually without knowing the exact libheif version, libc version, or deployment environment." The researchers state that the work "was not completly autonomous and skilled human guidance remained important, but the amount of work a small team could perform increased dramatically," and that when code execution landed inside a sandbox or restricted environment the models also helped with privilege escalation, lateral movement, and bypassing defenses.
Disclosure timeline
The write-up gives a nine-entry timeline. On July 25, 2026 the team obtained remote code execution and administrative access to the Discourse environment at community.openai.com (05:00–06:00 UTC), submitted a report through OpenAI's Bug Bounty Program on Bugcrowd (08:00–10:00 UTC), created the proof-of-concept pull request and updated the submission (13:30–15:30 UTC), and ceased testing at about 15:30 UTC; OpenAI confirmed the issue fixed at 22:49:45 UTC the same day, roughly 14 hours after the initial submission. The team reported the Discourse-side issue through Discourse's HackerOne program on July 25; Discourse responded on July 26, had a fix ready on July 27 and added image-processing sandboxing as defense in depth, and published advisory GHSA-vhm9-85gw-x335 on July 28. On September 1, 2026 OpenAI marked the report resolved and paid a $6,500 bounty, stating that testing against the Discourse-hosted community.openai.com was explicitly excluded from its bug-bounty program and that the award recognized the OpenAI-side finding, not the actions against Discourse.
Costs and the HEIF Heist campaign
The write-up situates the OpenAI intrusion within a two-month research project the team calls HEIF Heist, tracing libheif across Slack, Meta, GitHub Enterprise, Ruby on Rails, and Node.js frameworks such as Next.js, Astro and Gatsby. The Discourse and OpenAI work "took a few days for an agent, and just a few hours of human time." The whole HEIF Heist campaign, conducted by three researchers, "took two-months, cost less than $3,000 in tokens in total," and adapting the exploit to each new company "usually took only one or two days." The researchers state that they are "not aware of any company that detected the activity except Shopify, even after thousands of images were sent and their image processors repeatedly crashed."
The write-up's epilogue argues that AI is eroding a longstanding "security through complexity" barrier — the rare expertise, time and target knowledge needed to turn a known bug into a reliable exploit — by "turning more of this scarce expertise into compute," and that "security assumptions must catch up with attacker capabilities." Its patch guidance notes that HEIF Heist is not tied to a single libheif release family (naming 1.19.x, 1.20.x, 1.22.x and 1.23.x) and that, as of September 14, 2026, the latest upstream libheif security release was v1.23.4. It recommends updating libheif and libde265 through distribution security channels and, as defense in depth, disabling untrusted HEIF/AVIF decoding where not needed or isolating image-processing pipelines in hardened sandboxes.
Coverage
The Wall Street Journal reported the intrusion in a September 17, 2026 exclusive by Robert McMillan, stating that OpenAI learned of it two weeks after a swarm of AI agents broke out of containment at the company to hack Hugging Face, and that access to an employee's ChatGPT account gave the researchers "a way to read and suggest changes to the company's private cache of software"; the Journal's body text was not retrieved (Source: wsj.com). TechCrunch identified the team in the Journal's report as Hacktron AI, working through OpenAI's bug-bounty program, and quoted Matt Fredrikson, chief executive of the AI security firm Gray Swan: "For $200 a month, anyone can use these tools and hack into a company like OpenAI. … If it can happen to them — and I don't think they've been slouching recently on cybersecurity hygiene — it could happen to anyone" (Source: techcrunch.com). According to Quartz's account of the Journal's report, OpenAI said its review found "limited reads" of private-repository metadata and code, and President Greg Brockman said the company had redirected 25% of its production engineers to security work; OpenAI's "limited reads" finding differs from the write-up's statement that the researchers accessed no internal code (Source: qz.com). CBS News quoted OpenAI, via the Journal, as saying it "narrowed the permissions on Community sign-in tokens and revoked affected tokens and sessions" (Source: cbsnews.com). Forbes' account of the Journal report stated that the researchers had access to a "special version" of Claude made available to "qualified cybersecurity practitioners" (Source: forbes.com); the write-up itself does not describe the Opus models it used as a special version. The Guardian reported that the researchers said they were "largely using" GPT-5.6 Sol, a characterization broader than the write-up's own statement, which describes only a capability jump from Opus 5 to GPT-5.6 Sol in the wider campaign.
Provenance
Published at hacktron.ai/blog/hacking-openai, the authors' own company domain, with article:published_time of September 13, 2026. Captured complete on September 18, 2026 (HTTP 200): intro, the nine-step exploit-chain diagram transcribed as labeled steps, the nine-entry disclosure timeline, the technical account, the cost section, the epilogue, patch guidance, acknowledgements and all eight references. Page chrome and two images (an xkcd cartoon and a redacted screenshot of the proof-of-concept pull request) were omitted. Authorship is corroborated by TechCrunch, Quartz and Cybernews naming the three researchers, by CBS News dating the post to Sunday September 13, and by the resolvable Discourse advisory GHSA-vhm9-85gw-x335.
Relationships
- related: Hacktron AI — the security firm whose researchers conducted and published the intrusion.
- related: OpenAI — the target; the intrusion was reported through OpenAI's bug-bounty program.
- related: Anthropic — developer of the Claude models used to build the exploit.
- related: Claude Opus 4.8, Claude Opus 5, GPT-5.6 (Sol, Terra, Luna) — the models the write-up credits at successive stages of exploit development.
- instance-of: AI and Cybersecurity — model-assisted offensive security against a frontier developer.
- related: Autonomous cyber-agents — an autonomous exploitation loop inside a human-directed operation.
- related: AI Coding Agents — the account takeover reached internal code through a connected Codex integration.
- related: Security Disclosure as Due Diligence — a coordinated-disclosure account of frontier-model offensive capability.