LIVE FEED
HIGH PhantomRaven npm Stealer Built With LLM Targets Dev Secrets // HIGH SynthID Watermarking Weakens LLM Safety Guardrails Under Attack // HIGH RatHat Android Malware Uses Generative AI to Control Devices // FIRST LOOK OpenAI Reports Self-Injecting Prompts Found in Astra Compaction // CRITICAL OpenAI GPT-5.6 Sol Agents Hide Mistakes in Compaction Summaries // CRITICAL Heap Overflow and SSO Flaw Let Hackers Access OpenAI Repos // FIRST LOOK Base Labs and Hugging Face Launch Open-Weight AI Safety Standard // FIRST LOOK AWS AgentCore Harness Ships Built-In Shell and Identity Vault Tools // FIRST LOOK Apollo Research Launches Watcher to Monitor Rogue AI Agents // FIRST LOOK Anthropic Launches Claude Code Projects for Multi-Agent Cloud Orchestration //
ATLAS OWASP CRITICAL Active exploitation · Immediate action required LLM Security Agentic AI Supply Chain Research RELEVANCE ▲ 8.5

Heap Overflow and SSO Flaw Let Hackers Access OpenAI Repos

SOURCE OpenAI (via HN) ↗
TL;DR CRITICAL
  • What happened: Researchers chained a libheif heap overflow with an SSO flaw to access OpenAI's internal monorepo.
  • Who's at risk: Any organisation using Discourse with unpatched libheif and SSO-linked AI platforms is exposed to account takeover and internal repo access.
  • Act now: Audit SSO configurations for identity federation flaws between community forums and production AI services · Patch libheif and ImageMagick dependencies immediately, prioritising Discourse-hosted instances · Review connector permissions for AI tools like Codex and ChatGPT to limit lateral movement scope
Heap Overflow and SSO Flaw Let Hackers Access OpenAI Repos

Overview

On 25 July 2026, security researchers Harsh Jaiswal, Mohan Pedhapati, and Rahul Maini from HacktronAI chained two critical vulnerabilities to compromise multiple OpenAI employee accounts on ChatGPT and Codex. Within 72 hours of initial discovery, the team had obtained remote code execution (RCE) on OpenAI’s community forum, leveraged an SSO identity flaw to take over employee accounts, and demonstrated access to OpenAI’s internal GitHub monorepo (openai/openai) by opening PR #1186742. OpenAI was notified immediately and paid a $6,500 bug bounty upon patch coordination.

This incident matters because it demonstrates how a seemingly peripheral community forum can serve as a high-value entry point into the core infrastructure of a leading AI company — and how AI-native tools like Codex, with their broad third-party integrations, dramatically amplify the blast radius of account takeovers.

Technical Analysis

The exploit chain comprised two distinct vulnerability classes:

1. Heap Buffer Overflow in libheif (via ImageMagick on Discourse)

OpenAI’s community forum at community.openai.com runs Discourse, which uses ImageMagick for image processing. The Debian-packaged version of ImageMagick in use had not received a critical security backport patching a heap buffer overflow in libheif, the HEIF/HEIC image decoder library. By uploading a crafted HEIF image to the forum, the researchers triggered the overflow during server-side image processing, achieving RCE and administrative access to the Discourse environment.

2. SSO Identity Misconfiguration

Once administrative control of the Discourse instance was established, the team exploited a misconfiguration in OpenAI’s Single Sign-On (SSO) integration. The flaw allowed an attacker with Discourse admin access to impersonate any user who had logged into the forum — including OpenAI employees — and hijack their upstream OpenAI identity sessions. This yielded authenticated access to those employees’ ChatGPT and Codex accounts.

With Codex access, the researchers could interact with connected integrations (GitHub, Slack, email) under the identity of legitimate employees. Proof of access was demonstrated by opening a pull request in the internal monorepo.

Framework Mapping

  • AML.T0012 (Valid Accounts): Compromised employee SSO sessions provided persistent, legitimate-looking access to internal systems.
  • AML.T0113 (Steal Web Session Cookie): The SSO flaw effectively harvested valid identity tokens for privileged users.
  • AML.T0086 (Exfiltration via AI Agent Tool Invocation): Codex’s GitHub integration was the pivot point for demonstrating internal repository access.
  • LLM07 (Insecure Plugin Design): Codex’s broad connector permissions (GitHub, Slack, email) represent an excessive attack surface when the underlying account is compromised.
  • LLM08 (Excessive Agency): The scope of actions available through a single compromised Codex account — spanning multiple integrated services — illustrates the danger of over-permissioned AI agents.

Impact Assessment

The vulnerability affected any OpenAI employee or user who had authenticated to community.openai.com. The SSO chain meant that forum-level compromise directly translated to production AI tool access. Connected services including GitHub, Slack, and email were all within theoretical reach. The researchers deliberately limited their actions to avoid accessing sensitive data, but a malicious actor would face no such constraint.

Mitigation & Recommendations

  • Patch libheif and ImageMagick immediately on all Discourse or image-processing deployments, particularly where vendor-supplied packages lag upstream security fixes.
  • Audit SSO federation configurations to ensure community or support portals cannot be used as identity bridges into production systems.
  • Restrict AI agent connector permissions (Codex, ChatGPT plugins) using least-privilege principles — connected GitHub tokens should be scoped to the minimum required repositories.
  • Isolate forum infrastructure from production SSO domains where possible, using separate identity providers.
  • Monitor for anomalous PR or commit activity from employee accounts as a detection control for account takeover scenarios.

References

◉ AI THREAT BRIEFING

Stay ahead of the threat.

Twice-weekly digest of critical AI security developments — every story mapped to MITRE ATLAS and OWASP LLM Top 10. Free.

No spam. Unsubscribe anytime.