Two vulnerabilities, one in an image decoder used by the OpenAI help forum and one in the sign-in flow that links that forum to ChatGPT and Codex, were chained together in late July 2026 to take over employee accounts. Because Codex can be connected to services such as GitHub, the same chain opened a path to internal OpenAI code, and the finding was demonstrated with a benign pull request opened from a compromised employee account before testing was stopped.<\/p>\n
The forum at community.openai.com runs on Discourse and allows sign-in with OpenAI accounts through auth.openai.com. That link from a forum session to an OpenAI identity was the second half of the chain. The first half was an image upload. Discourse normally uses FastImage to inspect images, but HEIC, HEIF, and AVIF files are passed to ImageMagick’s The Debian 12 base image used by Discourse shipped libheif 1.19.7. Debian 13 shipped 1.19.8. Both carried a heap buffer overflow that had been fixed upstream but was not marked as a security fix and received no CVE, so it was not backported. As of September 14, 2026, the latest upstream security release is libheif v1.23.4; v1.23.2 has been superseded by further security fixes. Debian published its security update for Debian 13 on August 8, 2026.<\/p>\n Anthropic’s Claude Opus 4.8 was used to review the installed libheif package and locate the missing backport, then to build an exploit with ASLR disabled. Anthropic released Claude Opus 5 that evening. The newer model produced a working ARM64 exploit for a local Mac within three hours, then ported it to the x86-64 and jemalloc configuration used by Discourse. By 6:00 a.m. UTC on July 25, 2026, local remote code execution through an image upload had been confirmed.<\/p>\n The exploit was then run in an autonomous goal loop against a Discourse Cloud instance, reached remote code execution there, and was finally aimed at OpenAI’s own forum. No user interaction was needed once the crafted image was uploaded.<\/p>\n Administrative access to community.openai.com was enough because of how sign-in worked. The OpenAI SSO flow that backed the forum’s “Sign in with OpenAI” option carried the same trust into ChatGPT and Codex, so a forum compromise mapped onto a ChatGPT and Codex compromise without a password prompt. Any first-party or third-party OpenAI service using that SSO would have inherited the same exposure; the forum was just one way to prove it.<\/p>\n Connected integrations widened what a taken-over account could reach. With Codex linked to GitHub, the same account could open pull requests inside OpenAI’s internal monorepo. To show the path without reading any internal code, a prompt was sent to the compromised Codex account asking it to open PR #1186742 in openai\/openai, a benign change. Testing stopped after that.<\/p>\n The libheif issue is not specific to Discourse or OpenAI. The same research has been expanded into a multi-month investigation labeled HEIF Heist, tracing libheif through Slack, Meta, GitHub Enterprise, Ruby on Rails, and Node.js frameworks including Next.js, Astro, and Gatsby. Any application that processes user-controlled images and accepts .heic, .heif, or .avif files is likely affected if it is running an unpatched libheif or libde265.<\/p>\n Adapting the exploit to each new target usually took one to two days, and the total token spend across the broader two-month project was less than $3,000. Across the campaign, no company other than Shopify was observed detecting the activity, even after thousands of images were uploaded and image processors repeatedly crashed.<\/p>\n The standard upgrade advice is the only safe starting point. Install the latest security-patched libheif and libde265 packages through the distribution’s security channel, or move to the current upstream release. Because distribution packages often carry backports under an older upstream version number, the package security advisory matters as much as the version string. The ISO base media file format is complex and decoder updates are frequent, so future memory-safety flaws are likely. Disable untrusted HEIF and AVIF decoding where it is not needed, or isolate image-processing pipelines inside hardened, ephemeral sandboxes. ImageMagick’s security policy can restrict accepted formats and resource use.<\/p>\n Self-hosted Discourse operators should rebuild the container, not just update through the admin interface. Running Memory-corruption bugs used to require specialized expertise, considerable time, and detailed knowledge of the target environment. Known issues were costly to weaponize, so ordinary companies had practical protection even when vulnerable code and flaws were public. That protection is collapsing as memory-corruption exploits now take only hours of compute to build.<\/p>\n A realistic threat model should account for the economics of exploitation now, not the economics of exploitation a few years ago. A small team can use general-purpose models to turn a memory-corruption bug into a working exploit against an unfamiliar environment, including privilege escalation and lateral movement when code execution lands inside a restricted sandbox. Skilled human guidance still matters, but the volume of work a small team can perform has increased sharply.<\/p>\n A heap buffer overflow in libheif, exposed through Discourse’s image-upload pipeline when HEIC, HEIF, or AVIF files were handed to ImageMagick, gave remote code execution on the forum at community.openai.com. An OpenAI SSO misconfiguration then carried that forum session into ChatGPT and Codex without a password prompt.<\/p>\n Any deployment missing the latest upstream security patches is potentially affected, across multiple release families including 1.19.x, 1.20.x, 1.22.x, and 1.23.x. As of September 14, 2026, the latest upstream libheif security release is v1.23.4, and v1.23.2 has been superseded by further security fixes.<\/p>\n The full chain from initial discovery on July 23, 2026 to the benign pull request opened on July 25, 2026 took less than 72 hours. The broader two-month HEIF Heist campaign across Slack, Meta, GitHub Enterprise, and other targets cost less than $3,000 in tokens and was conducted by three researchers.<\/p>\nmagick<\/code> command for conversion, which calls libheif directly on attacker-controlled files.<\/p>\nFrom forum admin to ChatGPT and Codex<\/h2>\n
Timeline of the disclosure<\/h2>\n
\n
Who else was affected<\/h2>\n
What defenders should do now<\/h2>\n
git pull<\/code> and .\/launcher rebuild app<\/code> from \/var\/discourse<\/code> replaces the base image, while a web update alone may leave the vulnerable libheif dependency in place. Discourse-hosted customers have already been patched.<\/p>\nWhat the broader result implies<\/h2>\n
FAQ<\/h2>\n
What was the root cause of the ChatGPT and Codex account takeover?<\/h3>\n
What versions of libheif are affected?<\/h3>\n
How long did the full exploit chain take, and what did it cost?<\/h3>\n