HACKTRON researchers reported hijacking OpenAI staff members’ ChatGPT and Codex accounts through an image upload to OpenAI’s help forum, without phishing or a leaked password. The forum used Discourse, which sent HEIC and HEIF uploads to ImageMagick and the libheif library for processing. A heap buffer overflow in that process could allow an attacker to read or write outside the intended memory area. The researchers said the underlying flaw had been fixed upstream the previous year, but the fix had no CVE and had not been backported to Debian in time.
According to Hacktron, AI helped turn the memory-corruption bug into a working exploit. Claude Opus 5 reportedly produced an exploit against a local Mac in three hours, after Opus 4.8 struggled with ASLR enabled. The researchers then adapted it to Discourse’s x86-64 server using jemalloc, obtained root-level access on a test system, and used the exploit against OpenAI’s instance.
To demonstrate account access while limiting impact, they used one employee’s Codex account to open a harmless pull request in an internal repository; they said no source code was read, and nothing was merged or shipped. OpenAI confirmed a fix roughly 14 hours after the initial report and paid a $6,500 bounty, clarifying that the award covered the OpenAI-side finding rather than testing against the Discourse-hosted forum. Discourse had a patch ready the following Monday and added sandboxing for image processing.
Hacktron said the broader risk was OpenAI’s shared SSO, which could allow a compromise of another connected service to expose ChatGPT and Codex access.