Hacktron's Hacking OpenAI: 72 hours to an inside PR

The report's value lies not in any single flaw but in how its four steps combine. The first was image handling: Discourse's upload path used FastImage to inspect images, but because FastImage did not recognize HEIC/HEIF, those files were handed unchanged to ImageMagick and then to libheif. The second was a version gap that looks almost unfair — the libheif bug in Debian 12's 1.19.7 had been fixed upstream the previous year, but the fix arrived as a refactoring commit with no security label and no CVE, so Debian's security updates did not carry it, and the vulnerable version remained in both Debian 12 and Debian 13.

The researchers then used that bug as a foothold, leaning on Claude Opus 4.8 and later Opus 5 to build an exploit tuned to Discourse's environment (x86-64, jemalloc for memory management). They tested first on their own Discourse Cloud instance, then succeeded in remote code execution and admin access on OpenAI's forum. From there the path ran through the forum's "Sign in with OpenAI" SSO to an employee's ChatGPT/Codex account. The report does not disclose the exact SSO weakness, but its authors state plainly that the problem was OpenAI's SSO rather than something specific to Discourse.

Finally, the linked Codex agent was used to open a pull request in the openai/openai monorepo. The researchers stopped there by choice, so the damage was what they chose it to be. Their broader point is about speed: the step of building the attack code, historically the work of a skilled person over a long stretch, was compressed with AI help into less than 72 hours from finding the vulnerability to opening the PR.