The trail

Primary report: Hacktron AI, "Hacking OpenAI", 13 September 2026, by Harsh Jaiswal, Mohan Pedhapati, and Rahul Maini.

Companion primary: Discourse security advisory GHSA-vhm9-85gw-x335, published 28 July 2026 by davidtaylorhq. Severity High, CVSS 8.8. Credits hacktronai-research as reporter.

Together the documents describe a trust-boundary failure across three layers: a community forum image pipeline, an upstream decoder vulnerability, and OpenAI's SSO identity binding between the forum and ChatGPT / Codex.

What crossed the boundary (high level)

Hacktron's published chain, in their own ordering, runs:

  1. A vulnerable libheif path reachable through Discourse image uploads (HEIF/HEIC handling via ImageMagick)
  2. Remote code execution on the Discourse environment hosting community.openai.com
  3. An OpenAI SSO identity flaw that turned forum compromise into takeover of ChatGPT and Codex accounts for active forum users, including employees
  4. Downstream connector impact once Codex was tied to GitHub, demonstrated by prompting an employee's Codex to open a proof PR in an internal monorepo without reading sensitive code

Hacktron states the entire path from initial finding to repo proof ran in under 72 hours in late July 2026. OpenAI confirmed a fix on the OpenAI side roughly 14 hours after Bugcrowd submission. Discourse published the advisory with patched core versions and Docker rebuild guidance. OpenAI later awarded $6,500 and, per Hacktron's quotation of OpenAI's comment, scoped that award to the OpenAI-side finding. Testing against the Discourse-hosted community forum was explicitly excluded from OpenAI's bug bounty program.

This investigation does not reproduce, describe, or teach exploit construction. The operator lesson sits in the identity design. Decoder internals are out of scope.

The identity lesson

Hacktron's own framing: the escalatory vulnerability "is not Discourse-specific." It is an OpenAI SSO issue that turned forum compromise into access to ChatGPT and Codex. Any first-party or third-party OpenAI service using the same SSO could have served as the same bridge. Discourse was one proof surface.

That is a classic identity trust-boundary failure:

  • A lower-assurance community surface shared authentication with higher-assurance product and agent surfaces
  • Compromise of the lower surface became session authority for the higher ones
  • Connected tools (GitHub via Codex) expanded blast radius beyond chat history

OpenAI's bounty scoping reinforces the split: the forum RCE sits with Discourse's advisory and rebuild path; the SSO finding sits with OpenAI's identity posture.

Timeline (from Hacktron + GHSA)

When (2026)Event
25 Jul ~05:00-06:00 UTCHacktron obtains RCE / admin on community.openai.com Discourse
25 Jul morningBugcrowd report to OpenAI
25 Jul afternoonImpact proof via employee Codex PR; testing stopped
25 Jul ~22:49 UTCOpenAI confirms OpenAI-side fix
25-28 JulDiscourse HackerOne report; fix; GHSA published 28 Jul
1 SepOpenAI $6,500 bounty; marked resolved
13 SepHacktron public write-up

Patched Discourse versions listed in the advisory include 2026.7.0, 2026.6.1, 2026.5.2, and 2026.1.6 (among others). Self-hosters are told to rebuild via ./launcher rebuild app so the Docker image picks up patched libheif. Discourse-hosted customers were already patched per the advisory.

What remains UNKNOWN

  • Full technical detail of the SSO misconfiguration beyond Hacktron's high-level description (OpenAI has not published a matching incident post that we retrieved for this draft)
  • Whether other OpenAI SSO-consuming properties shared the same binding flaw before the 25 July fix
  • Detection coverage on the affected employee accounts beyond the disclosed PR proof

Operator takeaways

  • Map every surface that shares SSO with coding agents and source-control connectors. Treat forum, helpdesk, and marketing hosts as in-scope for the same identity review as the product IdP.
  • When a Discourse advisory says the Docker base image carries a vulnerable decoder, a web UI update is not enough. Rebuild the app container as the advisory instructs.
  • Separate bounty scope from security scope. A finding excluded from a vendor bounty can still be the load-bearing step in a chain that reaches paid product sessions.