• The chain was exploitable in production: a libheif heap overflow gave code execution on OpenAI's Discourse forum, and an OpenAI SSO flaw carried that into employee ChatGPT and Codex accounts.
• Hacktron says Claude Opus 4.8 failed to produce a working exploit once ASLR was enabled, while Opus 5 succeeded within hours of release. This is one researcher-reported before-and-after, not a benchmark.
• Hacktron and The Register both say no internal OpenAI code was read or copied. The proof of access was a pull request opened through an employee's Codex account.
• The libheif bug got no CVE, which Hacktron says slowed patching. Untrusted HEIC, HEIF and AVIF parsing needs a patched decoder and sandboxing.
• OpenAI confirmed its fix about 14 hours after submission and paid $6,500 for the OpenAI-side SSO finding. It says testing against the Discourse-hosted forum was explicitly out of bounty scope.

Three independent researchers at Hacktron chained a libheif image-decoder overflow with an OpenAI single sign-on flaw to take over employee ChatGPT and Codex accounts. They demonstrated access to OpenAI's internal GitHub monorepo by opening a pull request in it. The Wall Street Journal, as relayed by The Verge, reports the whole path took under 72 hours. The exploit-writing step ran on Anthropic's Claude Opus 5. What the researchers describe is a real, exploitable chain. What they do not describe is stolen source code.

Opus 5 cleared the ASLR wall that stopped Opus 4.8

The measurable difference between the two models was ASLR. Hacktron says Claude Opus 4.8 produced a working exploit only with address-space layout randomization disabled, and struggled across several sessions once it was enabled, as on Discourse's default configuration. Opus 5, released the evening of July 24, produced a working ARM64 exploit for a local Mac within three hours, according to the write-up. It was ported to x86-64 with the jemalloc allocator by 6:00 a.m. on July 25. That is one researcher-reported before-and-after on a single target, not a benchmark.

The SSO flaw, not the image bug, turned a forum compromise into account takeover

Code execution on a community forum stays contained until identity crosses the boundary. Hacktron says a misconfiguration in OpenAI's 'Sign in with OpenAI' single sign-on let the forum compromise escalate into takeover of employees' ChatGPT and Codex accounts. One takeover reached a Codex account connected to OpenAI's GitHub organization. The researchers prompted it to open pull request #1186742 in the internal monorepo and then stopped testing. The forum bug was the door; the identity trust between forum and product was the corridor.

No internal code was read

The Verge's summary says the monorepo reportedly contains OpenAI's algorithmic secrets, but Hacktron states it did not read or copy any internal code. Its proof of access was the pull request opened through the employee's Codex account, after which it stopped. The Register reports the same limit. 'Hacked into OpenAI' is accurate for account takeover and write-capable access, and inaccurate if read as exfiltration. We found no public evidence of what the repository held or that anyone read it.

OpenAI fixed the SSO issue in about 14 hours and paid $6,500

According to Hacktron's timeline, OpenAI confirmed its fix at 22:49 UTC on July 25, about 14 hours after the Bugcrowd submission. OpenAI issued a $6,500 bounty on September 1. OpenAI told The Register that testing against the Discourse-hosted community.openai.com was explicitly excluded from its bug bounty program, and that the award recognizes the OpenAI-side finding. The payout therefore covers the SSO weakness and its impact, not the forum compromise that supplied the foothold.

The unpatched-decoder problem outlasts this incident

The libheif flaw sat in upstream code without being documented as a security fix and received no CVE, which Hacktron says delayed distribution patching. It lists the 1.19, 1.20, 1.22 and 1.23 series as affected. Discourse's Debian 12 base shipped 1.19.7, and a fix was backported to Debian 13 by August 8, 2026. Discourse published advisory GHSA-vhm9-85gw-x335, adding image-processing sandboxing. CyberScoop reports that any deployment lacking the latest upstream patches is potentially vulnerable.

Speed and cost are the operational finding, and they are unaudited

Hacktron says the OpenAI and Discourse work took a few hours of human time. It says its wider HEIF Heist research, across two months, cost under $3,000 in tokens. It also used GPT-5.6 Sol for later blind-exploitation work, so this is not a one-vendor story. CyberScoop reports some RCE attempts needed thousands of image uploads, and that exploitation requires fingerprinting the target version and tailoring payload images. These figures come from the researchers, and we found no independent replication.

Verdict: exploitable, with a narrow claim actually proven

On a red-team scale this is exploitable, not theatre, and not a source-code breach. The chain worked against production and reached write-capable access through an employee's agent account. Unproven are any read of internal code and any generalization beyond one target. Defenders should patch image decoders, sandbox image processing, and treat the identity link between a forum and the main product as part of the trust perimeter. Watch for independent replication and for other exposed Discourse deployments.