AI-Assisted Exploit Compromises OpenAI’s Internal Systems via Forum Vulnerability
On July 25, 2026, security researchers from Hacktron demonstrated how a remote code execution (RCE) vulnerability in Discourse’s image-processing pipeline exploited with the help of Anthropic’s Claude Opus 5 allowed them to breach OpenAI’s community forum, hijack employee ChatGPT and Codex accounts, and access an internal source-code repository.
The attack began on community.openai.com, OpenAI’s Discourse-based help forum, where researchers Harsh Jaiswal, Mohan Pedhapati, and Rahul Maini discovered that HEIC/HEIF images bypassed standard security checks. Since FastImage did not support these formats, Discourse defaulted to ImageMagick’s magick utility, which relied on a vulnerable version of libheif (1.19.7). A heap-buffer overflow in the outdated Debian package (fixed in 1.19.8) enabled arbitrary code execution when malformed images were processed.
To weaponize the flaw, Hacktron initially used Claude Opus 4.8, which achieved local RCE but struggled with ASLR bypasses under Discourse’s default configuration. After Claude Opus 5 was released on July 24, the team tasked the newer model with refining the exploit. Within three hours, it generated a working ARM64 exploit, which was then adapted for Discourse’s x86-64 and jemalloc environment. By 6:00 UTC on July 25, the researchers confirmed RCE via image upload, later retrieving /etc/hosts from a proxied Discourse Cloud instance before deploying the exploit against OpenAI’s forum.
While forum-level RCE alone did not grant access to OpenAI’s monorepo, a separate identity misconfiguration allowed the compromised session to take over employee ChatGPT and Codex accounts without further interaction. To demonstrate access, the researchers used an affected Codex account linked to OpenAI’s GitHub organization to open a harmless pull request (#1186742) in the private openai/openai monorepo before halting further testing.
Hacktron reported the OpenAI-side vulnerability between 08:00 and 10:00 UTC on July 25, with OpenAI confirming a fix by 22:49:45 UTC a 14-hour response time. Discourse, which received a separate HackerOne report, patched the issue and released GHSA-vhm9-85gw-x335 on July 28. OpenAI awarded $6,500 for the finding, though testing the forum itself was outside its bug bounty scope.
The incident highlights how peripheral service vulnerabilities can escalate into high-value AI development environments when federated identity trust is misconfigured. The attack path from a public forum to internal repositories underscores the risks of connected applications with access to GitHub, Slack, and email. Self-hosted Discourse operators were advised to update libheif and rebuild containers, while organizations processing untrusted HEIF/HEIC/AVIF files were urged to isolate decoders in hardened sandboxes.
Source: https://cybersecuritynews.com/opus-5-to-help-exploit-openai-flaws/
OpenAI cybersecurity rating report: https://www.rankiteo.com/company/openai
Discourse cybersecurity rating report: https://www.rankiteo.com/company/civilized-discourse-construction-kit-inc
"id": "OPECIV1789712781",
"linkid": "openai, civilized-discourse-construction-kit-inc",
"type": "Vulnerability",
"date": "7/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'industry': 'Artificial Intelligence',
'name': 'OpenAI',
'type': 'Technology/AI Research'}],
'attack_vector': 'Malformed HEIC/HEIF image upload via Discourse forum',
'data_breach': {'file_types_exposed': ['Source code files'],
'sensitivity_of_data': 'High (internal repository)',
'type_of_data_compromised': 'Source code (limited access)'},
'date_detected': '2026-07-25T06:00:00Z',
'date_resolved': '2026-07-25T22:49:45Z',
'description': 'Security researchers from Hacktron demonstrated how a remote '
'code execution (RCE) vulnerability in Discourse’s '
'image-processing pipeline, exploited with the help of '
'Anthropic’s Claude Opus 5, allowed them to breach OpenAI’s '
'community forum, hijack employee ChatGPT and Codex accounts, '
'and access an internal source-code repository.',
'impact': {'brand_reputation_impact': 'Potential reputational risk due to '
'internal system access',
'data_compromised': 'Internal source-code repository access '
'(limited to a harmless PR)',
'financial_loss': '$6,500 (bug bounty payout)',
'operational_impact': 'Temporary access to internal systems; no '
'confirmed operational disruption',
'systems_affected': ['OpenAI’s community forum',
'Employee ChatGPT/Codex accounts',
'Internal GitHub repository']},
'initial_access_broker': {'entry_point': 'Discourse forum '
'(community.openai.com)',
'high_value_targets': ['Employee ChatGPT/Codex '
'accounts',
'Internal GitHub '
'repository']},
'investigation_status': 'Resolved',
'lessons_learned': 'Peripheral service vulnerabilities can escalate into '
'high-value AI development environments when federated '
'identity trust is misconfigured. Risks of connected '
'applications with access to GitHub, Slack, and email were '
'highlighted.',
'motivation': 'Security research and vulnerability demonstration',
'post_incident_analysis': {'corrective_actions': ['Patched libheif to 1.19.8',
'Fixed identity trust '
'misconfiguration',
'Released Discourse '
'advisory '
'(GHSA-vhm9-85gw-x335)'],
'root_causes': ['Heap-buffer overflow in libheif '
'1.19.7 (Discourse’s '
'image-processing pipeline)',
'Federated identity '
'misconfiguration allowing account '
'takeover']},
'recommendations': ['Update libheif and rebuild containers for self-hosted '
'Discourse operators',
'Isolate decoders for untrusted HEIF/HEIC/AVIF files in '
'hardened sandboxes',
'Review and secure federated identity configurations'],
'references': [{'source': 'Hacktron Research'},
{'source': 'Discourse Advisory (GHSA-vhm9-85gw-x335)'}],
'response': {'communication_strategy': 'Public disclosure via Hacktron and '
'Discourse advisory '
'(GHSA-vhm9-85gw-x335)',
'containment_measures': 'Patch applied to Discourse forum and '
'identity misconfiguration fixed',
'incident_response_plan_activated': True,
'remediation_measures': ['Updated libheif to 1.19.8',
'Rebuilt Discourse containers',
'Fixed federated identity trust '
'misconfiguration']},
'stakeholder_advisories': 'Organizations processing untrusted HEIF/HEIC/AVIF '
'files urged to isolate decoders in hardened '
'sandboxes.',
'threat_actor': 'Hacktron (Harsh Jaiswal, Mohan Pedhapati, Rahul Maini)',
'title': 'AI-Assisted Exploit Compromises OpenAI’s Internal Systems via Forum '
'Vulnerability',
'type': 'Remote Code Execution (RCE)',
'vulnerability_exploited': 'Heap-buffer overflow in libheif 1.19.7 (CVE not '
'specified)'}