A help-forum sign-in handed three researchers OpenAI employees' Codex accounts

The thing the chain captured was a session token. OpenAI runs its help forum on Discourse and offers "Sign in with OpenAI" through auth.openai.com ^[3], so whoever controlled the forum controlled the identity it handed back. Hacktron wrote in its September 13 post: "Since people can connect various services to Codex and ChatGPT, the scope of what we could theoretically access was huge, including GitHub, Slack and emails" ^[7][24].

The way in was a photograph. When a user uploaded a HEIC or HEIF file, the forum's FastImage check skipped it because FastImage does not support those formats, and the file went to ImageMagick, which opened it with libheif; that version of libheif had a heap buffer overflow ^[4]. Code execution on a forum host is not access to OpenAI. The second defect was OpenAI's own, a misconfiguration in its identity infrastructure, found by Harsh Jaiswal, Mohan Pedhapati and Rahul Maini ^[2].

OpenAI has said what it changed. "We narrowed the permissions on Community sign-in tokens and revoked affected tokens and sessions," an OpenAI spokesperson said in the Wall Street Journal report of September 18 ^[15][21]. By the Journal's account the researchers stopped as soon as they saw they could reach OpenAI's GitHub, because they did not want to touch sensitive data ^[21].

The price OpenAI put on the finding was $6,500 ^[9], for work three people did in under 72 hours from first finding to repository access ^[8][2]. Divide it: about $2,170 a researcher ^[16], or roughly $90 for every hour of that 72 ^[17]. Payment arrived on September 1, 38 days after the Bugcrowd report went in on July 25 ^[13][18]. OpenAI also said the Discourse-hosted forum was explicitly excluded from its bounty program, so the award covered the OpenAI-side finding and not the image bug ^[10].

Hacktron's general claim is that compute now substitutes for expertise, and it has one clean data point. Claude Opus 4.8 could not get the exploit working once ASLR was switched on. Anthropic released Opus 5 that evening, and within a few hours the newer model produced working code, which the team then adjusted to match Discourse's exact setup ^[12]. "This was never a real security boundary, but it protected ordinary companies in practice from software vulnerabilities," the researchers wrote of the complexity that used to slow attackers down ^[22]. Pedhapati told the Journal: "I don't think we are as strong as Chinese threat actors. We're just three guys with Claude and Codex subscriptions" ^[14].

Two readings are available and they price differently. One says this was two patchable defects in an unlucky combination, a stale image library inside somebody else's forum software plus a sign-on setting, both closed within days ^[20]. The other says the forum was never the asset, and the asset was whatever an employee had wired into Codex, so any login that mints a Codex session inherits that list. I lean to the second, largely because OpenAI wrote its remedy in the language of token permissions rather than model behaviour. The second reading fails if the community sign-in token was the only OpenAI login able to mint a Codex session, in which case one setting was mispriced and nothing structural. Hacktron, for its part, has turned the work into a multi-month project it calls HEIF Heist, tracing libheif through Slack, Meta, GitHub Enterprise, Ruby on Rails, Next.js, Astro and Gatsby, and it asks affected companies to email it ^[19].