Researchers Chained Two Bugs to Compromise OpenAI Internal Repos in 72 Hours
banteg · x · 2026-09-18
Security researchers Harsh Jaiswal, Mohan Pedhapati, and Rahul Maini published a detailed writeup of how they chained two critical vulnerabilities in July 2026 to compromise multiple OpenAI employees' ChatGPT/Codex accounts within 72 hours, gaining access to internal OpenAI repositories.
Exploit chain
- Heap buffer overflow in libheif: Debian lacked a security backport; ImageMagick uses libheif, and OpenAI's Discourse forum allowed image uploads, providing the entry point
- OpenAI SSO identity flaw: allowed takeover of employee ChatGPT/Codex accounts logging into the forum
- Connected services like GitHub, Slack, and email meant the theoretical blast radius was huge
Outcome: The team proved access by opening a PR in OpenAI's internal monorepo via the employee's Codex, immediately reported the bugs, coordinated patches with OpenAI and Discourse, and received a $6,500 bounty. LiveOverflow also published a YouTube video with technical details.
More from Safety
- Hundreds of offensive ARTEX AI agents deployed across VPS providers, hitting Korean banks — IgorCarron · 2026-11-04
- UK NCSC: AI will speed up and scale existing cyber attacks, not create new ones — koltregaskes · 2026-11-04
- Anthropic says it may imminently hit RSP threshold for AI-accelerated R&D, releases provable inference work — tobyordoxford · 2026-11-04
- Hackers reset French blood service freezers from -30°C to 110°C in supply-chain cyberattack — LuizaJarovsky · 2026-11-04
- Google says it removed post-employment non-disparagement clauses from new-hire terms — HaydnBelfield · 2026-11-04
- Claude doesn't really forget: Anthropic's privacy policy allows records retention up to 7 years — nikola_mr64990 · 2026-11-04