Skip to content
ThreadOut
s1r1us@S1r1u5_ · Sep 18, 2026

On July 25, we hacked OpenAI. Two bugs let us take over ChatGPT/Codex accounts of OpenAI employees (+some unaffiliated…

14 tweets2 min read♥ 8.1Koriginal

Summary

A security research team exploited two bugs to compromise OpenAI systems in under 72 hours: a heap overflow in the libheif image library and a critical SSO vulnerability that allowed them to take over employee ChatGPT accounts and access connected services like GitHub, Slack, and Outlook. They demonstrated the breach by creating a harmless PR in OpenAI's internal repository, and OpenAI patched the SSO flaw within 14 hours and awarded them $6,500.

Summarized by ThreadOut AI from the full thread. May miss nuance — read the thread below.

  1. #1

    On July 25, we hacked OpenAI. Two bugs let us take over ChatGPT/Codex accounts of OpenAI employees (+some unaffiliated users) and reach connected services: Outlook, Slack, GitHub, etc. We proved it with a PR in OpenAI’s internal codebase . It took us <72h. 🧵

  2. #2

    At a high level, this was the full exploit chain. 1. HEIC/HEIF upload 2. ImageMagick decoding 3. Heap overflow on libheif 4. RCE on community.openai.com 5. Critical OpenAI SSO flaw 6. ChatGPT/Codex takeover 7. Connected GitHub access 8. Internal repo PR #1186742

  3. #3

    The image package libheif had a known vulnerability, fixed upstream, but the fix never flagged as security-relevant and was still present in Discourse. Uploading a HEIF file gave us RCE on the OpenAI forum community.openai.com. github.com/strukturag/lib…

  4. #4

    The second bug is more serious: an OpenAI SSO vulnerability. Using this flaw, we turned our Discourse forum exploit into access to ChatGPT and Codex accounts belonging to people who had signed into it, including OpenAI employees.

  5. #5

    Those accounts could be (and some were) connected to Outlook, Gmail, Google Drive, Slack, GitHub, and other services via Codex or ChatGPT. This made the potential impact much larger than ChatGPT alone.

  6. #6

    To demonstrate impact while minimising exposure, we used one affected employee account connected to OpenAI’s GitHub org. Codex created a harmless PR in their internal monorepo without us reading sensitive code. That proved to us that the access was real.

  7. #7

    We reported the bug to Discourse and OpenAI. OpenAI fixed the SSO issue roughly 14 hours after our initial submission. Discourse received our separate report Saturday, replied Sunday, and had a fix Monday. OpenAI awarded us $6,500.

  8. #8

    AI agents did a meaningful share of the exploit work. Opus 4.8 found the libheif vulnerability and built a partial exploit. Hours after Opus 5 launched, it adapted the exploit to Discourse and achieved RCE on our test instance.

  9. #9

    Our main takeaway from hacking OpenAI: AI is reducing the amount of scarce expertise needed to develop exploits. Work that once took months can now take days. Even leading AI labs can be vulnerable. Defenders need to fix the architecture, patch faster, and limit the blast radius of connected things.

  10. #10

    This work was done by our team @HacktronAI led by @rootxharsh along with me and @iamnoooob. We have published the full details of the exploit chain, as well as how we discovered it, on our blog here: hacktron.ai/blog/hacking-o…

  11. #11

    @HacktronAI @rootxharsh @iamnoooob also we are not some random dudes, check our work before, we work with companies like perplexity and vercel. hacktron.ai/blog/

  12. #12

    @HacktronAI @rootxharsh @iamnoooob Check out @LiveOverflow video youtube.com/watch?v=gjHh9g…

  13. #13

    @HacktronAI @rootxharsh @iamnoooob @LiveOverflow After we hacked openai, we started looking into other companies that was affected by same image parser, the bug affects numerous companies including slack, github ent, meta etc.

    Harsh Jaiswal@rootxharsh · Sep 18, 2026

    We’re disclosing HEIF Heist, a months-long investigation into libheif that allowed us to hack OpenAI, Slack, Meta, GitHub Ent, Rails, Next.js, ImageMagick, and many more. It was literally xkcd #234, one obscure image library beneath a huge number of apps. 🧵

  14. #14

    @HacktronAI @rootxharsh @iamnoooob @LiveOverflow multiple labs use slack, we could've leaked every private images and other files uploaded to slack

    Harsh Jaiswal@rootxharsh · Sep 18, 2026

    This affects huge number of applications, we will disclose technical details of every major company in coming weeks at hacktron.ai/blog . For example; Slack which is used by multiple AI companies and we could have leaked any user's uploaded files via our RCE.