Researchers found a Discourse/libheif flaw, chained it to OpenAI employee accounts and Codex-linked GitHub access, then stopped after proving
This research was disclosed by Hacktron. The core path began by entering OpenAI’s community forum, which is built on Discourse, and then chaining access to employee ChatGPT accounts and OpenAI’s internal code repositories. In a test lasting less than 72 hours, researchers first found a security issue in the forum’s image-processing component, then took control of multiple OpenAI employee accounts, and finally used one employee’s Codex instance, already connected to OpenAI’s GitHub organization, to confirm that internal code repositories could be operated. After verification was completed, testing stopped and no internal source code was viewed.
Sources indicate that OpenAI’s community forum used libheif to process HEIC/HEIF images, and the version in use at the time had a heap buffer overflow-related issue. Discourse later announced it as CVE-2026-32882 and assigned it a CVSS 3.1 score of 8.8, classifying it as a high-risk vulnerability. Researchers reported it through OpenAI’s bug bounty program on July 25, OpenAI confirmed the fix about 14 hours later, and the case was marked resolved on September 1.
The first part of the technical chain was the image parser attack surface. The forum allowed users to upload images, and libheif handled the parsing of formats such as HEIC and HEIF; if the parser’s handling of specially crafted images caused a memory boundary error, an attacker could trigger code execution on the server side. The sources state that Claude Opus 4.8 was initially used to help develop the exploit, but it could not be used reliably in Discourse’s default ASLR-enabled environment. After switching to Claude Opus 5, an exploit that worked in a local Mac ARM64 environment was completed in about three hours, and it was then adapted to Discourse’s x86-64 environment, ultimately achieving remote code execution.
The second part was the amplification effect of identity and authorization chains. After taking over the forum server, researchers further used problems in OpenAI’s SSO mechanism to control multiple employee ChatGPT accounts. The key issue here was not the compromise of a single account, but the connection between employee accounts and internal workflow tools; one employee’s Codex was connected to OpenAI’s GitHub organization, extending the attack surface from the application layer to the code collaboration layer. To confirm the privilege boundary, researchers asked Codex to create a harmless pull request, proving that internal repositories could be operated, but they did not access any content further.
The third part is the role of AI tools in vulnerability research. This case does not mean AI autonomously carried out the intrusion; rather, researchers led the attack path, environment identification, and exploit-condition tuning, while Claude helped accelerate exploit development. The sources also mention that extending similar research to other services supporting HEIF, HEIC, and AVIF still required confirming the target version, adjusting the image payload to the actual environment, and in some remote code execution tests, uploading thousands of images. This shows that AI can shorten development time, but it cannot replace precise analysis of the target stack, version, and defensive mechanisms.
The direct impact focused on three layers. The first layer is the forum and image upload flow; as long as a service uses the affected libheif and allows external HEIF/HEIC uploads, it may become the initial entry point. The second layer is the employee account and SSO integration layer; when a community platform or support system interoperates with internal identity authentication chains, a compromise of one external service can extend to internal work accounts. The third layer is development collaboration and code repositories; if employee Codex, GitHub organizations, or other automated development tools are already integrated, an attacker may be able to move from the account layer to internal project workflows.
The broader risk is that this type of issue is not limited to OpenAI. Hacktron has expanded the research to other services supporting HEIF, HEIC, and AVIF, and related CyberScoop reporting notes that successful exploitation in different services still requires version- and environment-specific adjustments, with some tests requiring the upload of large numbers of images. In other words, any service relying on underlying decoding libraries such as libheif or libde265, while also taking a permissive approach to image uploads at the front end, could face similar risk.
First, image-decoding components must be included in asset and vulnerability management. For widely used parsers such as libheif and libde265, vendor advisories and known-vulnerability databases should be continuously compared, and patched versions should be deployed immediately. The sources note that the fix information corresponding to CVE-2026-32882 should be prioritized in maintenance scheduling.
Second, the upload surface should be forcibly isolated. Image processing for forums, customer support systems, and collaboration platforms should be separated from core services, decoder privileges should be restricted, the host access scope of file-processing processes should be reduced, and higher scrutiny and quota controls should be applied to high-risk formats such as HEIF, HEIC, and AVIF. If the business does not require these formats, they should be disabled entirely.
Third, SSO and workflow integration should use least-privilege design. If employee accounts can connect to ChatGPT, Codex, GitHub organizations, or other internal tools, each authorization step should be independently revocable, and abnormal logins, device fingerprints, geolocation, and behavior monitoring should be added. Accounts that can create pull requests, submit code, or trigger automation should use stronger authentication.
Fourth, a rapid patching and verification process should be established for external research reports. This event shows that the window between disclosure and remediation can be very short, but only if the organization already has a complete chain for response, verification, deployment, and rollback. Without observability, even if a vulnerability has been patched, it may still exist in other systems or older versions.
Fifth, AI-assisted development and security research should be treated as an efficiency multiplier, not a risk eliminator. Enterprises need to govern two things at once: first, enabling defenders to use AI to accelerate vulnerability analysis and remediation; second, preventing attackers from using AI to quickly generate exploits, iterate environment adaptation, and bypass defenses. The real line of defense remains version management, privilege segmentation, file isolation, and continuous monitoring.