On 18 September 2026, Harsh Jaiswal (@S1r1u5_) posted that his team had hacked OpenAI on 25 July. Two bugs, he wrote, let them take over ChatGPT and Codex accounts of OpenAI employees and some unaffiliated users, reach connected services, and prove it with a pull request in OpenAI’s internal codebase. The chain, in his words: a HEIF upload, ImageMagick, a libheif heap overflow, remote code execution on community.openai.com, an OpenAI SSO flaw, account takeover, GitHub, then PR #1186742. OpenAI paid $6,500.
The thread matches the team’s own write-up, a Discourse advisory with a CVE, a public libheif commit that never said it was a security fix, and a Business Insider story. The PR itself is not on the public internet. Keep the identity lesson; skip the cinema of “we hacked OpenAI.”
Quick answer
If a property shares SSO with ChatGPT or Codex, treat that property as inside the agent identity perimeter. Hacktron (Harsh Jaiswal, Mohan Pedhapati, Rahul Maini) chained a libheif remote-code-execution path on OpenAI’s Discourse forum with a separate OpenAI SSO flaw. Forum members who had signed in with OpenAI, including employees, could have ChatGPT and Codex taken over with no further click. One employee’s Codex was connected to OpenAI’s GitHub org; the researchers prompted that Codex to open a harmless PR in the internal monorepo and stopped. OpenAI fixed the SSO issue about 14 hours after the Bugcrowd report. Discourse published GHSA-vhm9-85gw-x335 (CVE-2026-32882) three days later. The $6,500 bounty covers the OpenAI-side finding only. If your team already connected GitHub, Slack, or mail to ChatGPT or Codex, inventory those grants this week and shrink write scopes before you add another connector.
Best for: security, platform, and AI-engineering leads who let staff connect GitHub, Slack, or mail to ChatGPT, Codex, or any agent that inherits the same login. Honest limit: Cipher did not reproduce this chain and is not your incident responder. We come from cloud and security work, then AI. This page maps confirmed public facts to a lock-down list. It is not a substitute for OpenAI, Discourse, or your IdP vendor on your exact tenant.
Last updated: 18 September 2026. Cipher Projects is an Australian-led engineering studio. We review agent identity, connectors, and sandboxes. We are not an IRAP assessor.
Is the @S1r1u5_ OpenAI hack thread true?
The core claims check out against primary sources. A few numbers in the thread need the write-up next to them, and one proof (the internal PR) cannot be inspected from outside OpenAI.
| Claim in the thread | What we can check | Verdict |
|---|---|---|
| On 25 July they reached OpenAI employee ChatGPT / Codex accounts from the community forum | Hacktron write-up (13 Sep 2026) and Business Insider | Confirmed as researcher + press reporting. OpenAI has not published its own incident note. |
| HEIF upload → ImageMagick → libheif heap overflow → RCE on community.openai.com | Discourse GHSA-vhm9-85gw-x335 credits Hacktron and names CVE-2026-32882. Upstream commit 85e21ad exists and is titled “simplify overlay overlap area computation,” not a security fix. | Confirmed at the class-of-bug level. Do not treat a tweet as a repro guide. |
| A second, more serious OpenAI SSO flaw turned forum RCE into ChatGPT / Codex takeover | Hacktron: the escalation is not Discourse-specific; any compromised service on that SSO plane would have given the same access. OpenAI’s bounty comment, quoted in the write-up, recognises an OpenAI-side finding. | Confirmed as a disclosed identity bug. The exact SSO mechanic is not public, which is correct. |
| Connected Outlook, Gmail, Drive, Slack, GitHub were in play | Hacktron says those connectors exist on ChatGPT / Codex and that the theoretical scope was huge. The demonstrated hop was GitHub via one employee Codex. | Potential impact: stated. Proven hop: GitHub. Do not inflate the rest into “they read everyone’s mail.” |
| Harmless PR #1186742 in the internal monorepo, without reading source | Write-up: they prompted the employee’s Codex to open a PR in openai/openai, then stopped. Link redacted at OpenAI’s request. Timeline row: 25 July 13:30–15:30 UTC. |
Believable and internally consistent. Not independently visible. |
| Under 72 hours; OpenAI fixed SSO in about 14 hours; Discourse patched Monday; $6,500 bounty | Write-up timeline: RCE 05:00–06:00 UTC 25 July; Bugcrowd same morning; OpenAI-side fix confirmed 22:49 UTC; Discourse HackerOne Saturday, reply Sunday, fix Monday 27 July; advisory 28 July; bounty marked 1 Sep. OpenAI: testing community.openai.com was out of bounty scope; $6,500 is for the SSO finding. | Confirmed, with that bounty-scope caveat. |
| Opus 4.8 found the libheif issue; Opus 5 adapted it to Discourse | Researcher-reported, including Anthropic’s Cyber Verification Program per Business Insider. Cipher did not rerun those sessions. | Take as their method note, not as a lab result we measured. |
If you only need one sentence for a standup: the forum bug was a stale image decoder; the company-ending bug was SSO plus an agent that already held GitHub.
What was the public exploit chain, without the exploit?
OpenAI’s help forum runs Discourse and offers “Sign in with OpenAI” through auth.openai.com. Hacktron argued that a compromise of that forum could become a compromise of ChatGPT and Codex because the login plane was shared. They went looking for remote code execution on the forum to test the hypothesis.
Discourse usually checks uploads with FastImage. HEIC and HEIF files did not fit that path, so those uploads went to ImageMagick, which decoded them with libheif. The copy of libheif in Discourse’s Debian 12 Docker image (1.19.7) was missing an upstream fix from May 2025. That commit never carried a CVE or a security label, so Debian had not treated it as a security backport. Uploading a crafted HEIF file was enough, in their account, to get code execution on community.openai.com.
That is as far as this page goes on the decoder. If you self-host Discourse, rebuild the container. A web-UI update may not replace the image. Discourse-hosted customers were patched. The advisory is GHSA-vhm9-85gw-x335; the upstream ID they published is CVE-2026-32882, CVSS 8.8.
The second bug sat in OpenAI’s identity layer. Once they had the forum, they say they could take over ChatGPT and Codex accounts of people who had signed into it, with no further victim action. Discourse was one door. Hacktron’s line, which is the one worth keeping: any first-party or third-party OpenAI service on that SSO would have given the same access.
Why was the SSO bug worse than the forum RCE?
Because the forum was filed as support, and the SSO plane was production identity. Compromising a help community is ugly. Compromising the login that community shares with ChatGPT and Codex is a standing grant to every connector those products already hold.
ChatGPT and Codex can connect Outlook, Gmail, Google Drive, Slack, GitHub, and other services. Those are not “plugins for chat.” They are OAuth grants sitting on an account. If the account falls, the grant is live until someone revokes it at the provider. That is why the researchers called the SSO issue more serious than the image decoder, and why a $6,500 bounty on the identity finding is the number that should bother you more than the RCE headline.
The cutover we use when we review agent platforms: if a property shares SSO with ChatGPT or Codex, treat that property as inside the agent identity perimeter. Put it on the same inventory as the coding agent, not on the same inventory as the marketing site. The Artifactory sibling of this page said a writable registry is fleet code execution. This incident is the identity twin. A writable connector on a shared login is fleet action in GitHub, Slack, or mail.
We already argued that Claude Projects and ChatGPT workflows are not production agents until identity, connectors, and audit exist. That page is Claude workflow vs production agent. July 25 is the worked example of skipping the identity row.
What did the Codex pull request actually prove?
It proved Codex was already a privileged GitHub identity, not that the researchers had sat down and read OpenAI’s source.
After they confirmed account takeover, they picked one affected employee whose Codex was connected to OpenAI’s GitHub organisation. They sent a prompt to that Codex asking it to open a pull request in the internal monorepo. They say they did not browse the code. They updated Bugcrowd, pinged people at OpenAI, and stopped testing around 15:30 UTC on 25 July. The PR number in the thread is 1186742. The URL is redacted.
That is a clean impact proof and a warning about how teams now ship access. You no longer need a human to click around GitHub after a session is stolen. The agent will accept a prompt. If your Codex or Claude Code session can open PRs, merge, or push, the session is a deploy key with a chat box on the front. Inventory it that way.
| Forum RCE (libheif / Discourse) | OpenAI SSO + Codex | |
|---|---|---|
| What it buys | Code execution on the Discourse host | ChatGPT / Codex of people who had signed into the forum |
| Public ID | CVE-2026-32882, GHSA-vhm9-85gw-x335 | No CVE. Fixed by OpenAI about 14 hours after the report. |
| Bounty | Out of OpenAI’s programme (hosted Discourse) | $6,500 for the OpenAI-side finding |
| Best for (attacker math) | A foothold on a community box | Every connector hanging off the stolen account |
| Honest limit of the public record | We have an advisory and a patch path | We have a researcher write-up, not an OpenAI post-mortem |
What should you lock down this week if ChatGPT or Codex holds GitHub?
Assume every connector on a ChatGPT or Codex account is a standing grant. Then cut the ones you cannot name a job for.
| When | Do this | Why |
|---|---|---|
| Today | List every ChatGPT / Codex / Claude account that can reach GitHub, Slack, Google, or mail. Include personal accounts on work laptops. | You cannot shrink a grant you have not named. Shadow-AI is the usual miss; we wrote that up for Australia in the AI inventory post. |
| Today | In GitHub, Slack, Google, and Microsoft admin, revoke OAuth apps you do not recognise. Re-issue only the intended workspace, least privilege, no org-wide write if a single repo will do. | Logout on the laptop is local cleanup. It does not revoke the provider grant. |
| Today | If you self-host Discourse, rebuild with ./launcher rebuild app so the Docker image picks up patched libheif. Confirm you are on a patched train (2026.7.0, 2026.6.1, 2026.5.2, or 2026.1.6). |
A settings-page update can leave the old decoder in the image. Discourse-hosted is already patched. |
| This week | Turn off write, send, delete, publish, and merge actions on connectors unless a named workflow needs them. Prefer read-only plus an approval step for PRs. | The OpenAI proof was a prompt to an agent that could already open a PR. Read-only would have made that proof a 404. |
| This week | Put help forums, status pages, and “Sign in with <product>” apps on the same SSO review as production. If they share the agent login, they are in the perimeter. | community.openai.com was a support property in the org chart. It was an identity host in the graph. |
| This week | If your app decodes untrusted HEIC, HEIF, or AVIF, isolate that work in an ephemeral sandbox or disable the formats. Check the distro security channel for libheif, not only the marketing version number. Debian 13’s security update was DSA-6417-1 (8 August 2026). Upstream’s then-current security release, per Hacktron on 14 September, was libheif 1.23.4. | The May 2025 overlay fix never said “security.” Distros that wait for a CVE will ship the hole. |
| This month | Give coding agents their own GitHub App or bot identity, not a human SSO session that also reads mail. Separate the forum login from the agent login if your vendor lets you. | One stolen cookie should not be a monorepo plus Slack plus Outlook. |
If you also run a package registry next to agents, do the Artifactory pass on the same calendar. That write-up is CVE-2026-82329 and agent attacks. Registry write and connector write are the same class of standing grant.
Did AI remove the scarce part of exploit work?
Hacktron’s takeaway is economic, not cinematic. Opus 4.8 found the stale libheif fix and built a partial exploit. After Opus 5 shipped, they say it adapted the work to Discourse and got code execution on their test instance. The whole OpenAI chain, in their timeline, sat inside 72 hours. Their broader HEIF Heist programme (they name Slack, Meta, GitHub Enterprise, Rails, and several Node frameworks) ran about two months, cost under $3,000 in tokens, and used three researchers. Cipher has not audited those other targets. Treat that paragraph as their research note.
Software used to be protected by how expensive a reliable exploit was, even when the bug was public. Models are turning that scarce skill into compute. Defenders win by shrinking blast radius so a decoder bug on a forum cannot become a GitHub session, and by patching the boring defaults on a clock. Same shape as the Artifactory week and the sandbox comparison: assume the agent is hostile the moment it can run a tool, and do not leave production identity in the same room.
FAQ
Can I see pull request 1186742? No. Hacktron says OpenAI asked them to redact the link. Believe the impact class (Codex could open an internal PR) without pretending you have read the diff.
Did they read OpenAI’s source? They say they did not. The proof was a prompt to Codex, then they stopped. Take them at that, and still rotate anything that account could have touched.
Was the $6,500 bounty for the whole chain? No. OpenAI’s comment, in the write-up, says testing the Discourse-hosted forum was out of scope. The award is for the OpenAI-side SSO finding.
We do not use Discourse. Are we clear? You are clear of CVE-2026-32882. You are not clear of the identity lesson. Any app that offers “Sign in with our product” next to ChatGPT, Codex, or a coding agent is a candidate for the same perimeter review.
We connected GitHub to Codex last month. What is the first click? GitHub Settings → Applications → Authorized OAuth Apps / GitHub Apps. Revoke anything you cannot name. Reconnect a bot or GitHub App with the smallest repo list and no org-wide write. Then do the same in Slack and Google if those connectors exist.
Should we ban ChatGPT and Codex until this settles? No. Ban standing write grants on a shared human login. Keep the agent, split the identity. A freeze nobody will follow is how the next grant sneaks back in on a Friday.
Who should review this for an Australian or Singapore team? A partner who already does cloud and security, not only prompt engineering. Cipher Projects will walk ChatGPT / Codex / Claude connectors, SSO adjacency, and the sandbox under your accounts. We do not replace your incident responder if you are already breached. Start at Security Engineering or contact.
Related: CVE-2026-82329 and agent attacks · Claude workflow vs production agent · Where agent code should run · Code scanning for AI coding tools · OpenAI Codex vs Claude Code · AI inventory and shadow AI · Security Engineering