What is confirmed
On 25 July 2026, Harsh Jaiswal, Mohan Pedhapati and Rahul Maini demonstrated code execution on community.openai.com, then takeover of multiple forum-linked ChatGPT/Codex accounts. Their technical report was published on 13 September.
One employee account was connected to OpenAI's GitHub organisation. The researchers asked Codex to create a harmless pull request in the private openai/openai monorepo to prove the reach of that access, then stopped testing.
What it means
The chain joined libheif, ImageMagick, Discourse, the public forum, an OpenAI-side SSO weakness and Codex's GitHub integration. The forum flaw alone did not automatically grant internal account access.
The research demonstrates a path to a private repository, not access to every OpenAI server or reading of sensitive code. This was security research disclosed to the vendors; OpenAI paid a $6,500 bounty for the OpenAI-side flaw.
A HEIF image as the entry point
Discourse passed some HEIC/HEIF uploads to ImageMagick, which used libheif for decoding. The researchers exploited a memory overflow in a vulnerable library version in the forum's Docker image. An upstream change existed, but the deployed dependency chain lacked the needed security fix.
From the forum to SSO and Codex
After gaining access to the forum server, an OpenAI-side identity flaw allowed takeover of forum users' ChatGPT and Codex accounts, including employees'. One Codex account's GitHub integration provided proof of access to internal repositories. The researchers say they did not download repository code.
What Claude Opus 5 changed
Hacktron says Claude Opus 4.8 found the bug but could not make the exploit reliable with ASLR enabled. After Opus 5 was released, a fresh session produced a working exploit adapted to the target environment. The researchers guided the process; this does not demonstrate an autonomous attack without human expertise.
Under $3,000: the correct scope
The path from initial discovery to OpenAI repository access took under 72 hours. Hacktron estimates under $3,000 in AI tokens for its entire HEIF Heist project, spanning roughly two months and multiple targets. It does not publish a separate $3,000 cost for OpenAI alone.
Fixes and lessons for organisations
Hacktron says OpenAI confirmed an identity-side fix on 25 July; Discourse prepared a fix on 27 July and issued an advisory on 28 July. Self-hosted Discourse operators must rebuild the image with patched dependencies: an update through the web interface may leave an old library in the container.
What to do
Inventory untrusted image-processing paths, check libheif and libde265 security patches in actually deployed images, and isolate file converters with minimal privileges.
Audit SSO links between public services and internal accounts; review GitHub integrations, AI-agent privileges and persistent tokens. Monitor pull-request creation, unusual sign-ins and anomalous use of connected accounts.
An external check can help triage an exposed website. For this type of chain, also audit dependencies, SSO, connected accounts and internal logs.
