Hacktron AI details exploit chain: libheif heap overflow and SSO flaw led to OpenAI internal repo access
anshulkundaje · x · 2026-09-19
Security team Hacktron AI has published full details of an exploit chain they executed on July 25, 2026, taking less than 72 hours from discovery to compromising multiple OpenAI employees' ChatGPT accounts — and opening a PR in OpenAI's internal monorepo via an employee's Codex as proof, without reading any sensitive data.
The chain: a heap buffer overflow in the libheif image decoder (missing Debian security backport), reached through ImageMagick and Discourse image uploads on OpenAI's community forum, combined with an OpenAI SSO identity misconfiguration to achieve ChatGPT/Codex account takeover. Since Codex and ChatGPT can connect to GitHub, Slack and email, the theoretical blast radius was huge.
The team responsibly disclosed to OpenAI and Discourse, coordinated patches, and received a $6,500 bounty. Their takeaway: AI is drastically shrinking the scarce expertise needed to develop exploits — work that once took months now takes days.
More from AGI Musings
- Investor: in the LLM era 'did it work' replaces diplomas and test scores — StewartalsopIII · 2026-11-04
- Should AGI labs have a reverse Conway's Law — design the org from the artifact? — akbirthko · 2026-11-04
- Verification Is Not Knowledge: Science needs more than AI answers — ersinesen · 2026-11-04
- Andreessen: Agents Are Entering Enterprises as Chaos, Just Like PCs and Spreadsheets Did — Dan_Jeffries1 · 2026-11-04
- 1000+ mathematicians sign pledge to shun AI companies and models — Shesawthat · 2026-11-04
- Von Neumann meme: "You don't have to be responsible for the world that you're in" — akbirthko · 2026-11-04