Build1 publisher2 min readPublished
Two ordinary defects carried Hacktron from a forum image upload to OpenAI's internal monorepo
Hacktron's path into OpenAI's internal repos ran through a libheif bug Debian had not backported and a single sign-on flow that trusted community.openai.com. The dev.to breakdown says the model changed what the attack cost. The category of attack was the same either way.
The Engineer · Build desk
What happened
- Hacktron published a full disclosure on September 18 describing how its researchers Harsh Jaiswal, Mohan Pedhapati and Rahul Maini reached OpenAI's internal monorepo two months earlier under the company's Bugcrowd bounty program.
- A crafted HEIF upload to community.openai.com produced a heap buffer overflow and remote code execution, giving the team admin access to the forum server by the morning of July 25.
- Holding forum admin, a misconfiguration in the Sign in with OpenAI flow let them take over the ChatGPT and Codex accounts of employees who had previously logged into the forum, with no further authentication.
- They opened one pull request against a README, number 1186742, stopped all testing at 15:30 UTC on July 25, and say they did not browse or download OpenAI source code.
- OpenAI awarded $6,500 and scoped the award to the OpenAI-side finding, because the community forum was explicitly excluded from the bounty program.
Compiled by The EngineerSomething wrong?How this is made
Why it matters
- constraint Distribution backport triage keys off security labels and CVE numbers, so an upstream fix that ships as an ordinary commit can leave a stable base image exposed for a year while operators believe their patch level is current.
- exposure Employee ChatGPT and Codex accounts are only as isolated as the weakest service on the auth.openai.com identity path, and the researchers say third-party services sit on that path too.
- precedent Bounty scope and trust scope came apart here, so the next scoping decision has to be argued against the identity graph: an asset can be excluded from payment while still authenticating staff.
- decision Anyone accepting image uploads now has to establish which decoder handles the formats their validator cannot read, because the fall-through picks the parser and it picks outside the config.
Discourse validates uploaded images with FastImage, and FastImage does not understand HEIC or HEIF, the formats iPhones produce by default [9]. Those files fall through to ImageMagick, which decodes them with libheif [9].
The libheif inside Discourse's Docker image, built on Debian 12, was 1.19.7, and it was missing upstream security fixes [10]. Upstream had fixed the bug the previous year, but the commit was not documented as a security fix and received no CVE [11]. According to the dev.to breakdown, that is likely why Debian had not backported it [11]. Debian 13 was still shipping a vulnerable 1.19.8, and Debian published its own security update on August 8, 2026 [12], fourteen days after the researchers stopped testing [2]. Discourse later confirmed the flaw as CVE-2026-32882 with a severity of 8.8 [13].
The write-up lays the path out as nine stages: libheif, the missing Debian backport, ImageMagick, Discourse image uploads, the community.openai.com forum, an OpenAI SSO identity flaw, ChatGPT and Codex account access, a connected GitHub integration, and the internal repositories [8]. Two of those are defects [20], and the other seven worked as designed [1].
The forum's login button points at auth.openai.com [15]. According to the researchers, if any first-party or third-party OpenAI service on that identity path were compromised, the same takeover would follow, and Discourse was just the proof [16]. One Codex account they reached was connected to OpenAI's GitHub organization [17].
OpenAI confirmed a fix on its side roughly 14 hours after the Bugcrowd submission [5]. Discourse shipped its fix within days and published advisory GHSA-vhm9-85gw-x335 [6].
The version that circulated this week says three researchers and a Claude model breached OpenAI's internal codebase in 72 hours, with the model writing the exploit [18]. The dev.to breakdown's position is that no exotic AI vulnerability was involved, and that the AI changed the cost of the attack, not its category [19]. It does not say which step in the chain the model produced. Both defects are the kind a human team finds on a good week. In my view, what a model changes is how many upload paths get probed before one of them falls through.
What to watch
- Whether Discourse rejects formats FastImage cannot parse instead of handing them to ImageMagick.
- Whether OpenAI brings community.openai.com into its Bugcrowd scope now that a forum bug reached the monorepo.
- Whether libheif starts labelling security-relevant commits so distribution backport triage can see them.