cd /news/ai-safety/reaching-an-internal-openai-reposito… · home › topics › ai-safety › article
[ARTICLE · art-134283] src=dev.to ↗ pub= topic=ai-safety verified=true sentiment=↓ negative

Reaching an Internal OpenAI Repository Through an HEIF RCE and Overprivileged SSO Token Chain

Researchers at Hacktron AI chained a heap overflow in the libheif HEIF image decoder (CVE-2026-32882) with an overprivileged OpenAI SSO token to achieve remote code execution on OpenAI's Discourse forum and gain access to an employee's ChatGPT/Codex account. From there, the connected GitHub integration allowed the team to read internal repository metadata and open a harmless README pull request as a proof of impact. The researchers used Claude Opus 4.8 and Claude Opus 5 to help develop the ASLR-bypassing exploit, though they said expert guidance was still required and the process was not fully autonomous.

by read6 min views2 publishedSep 19, 2026

#

  1. Basic Information
- Original Title: Hacking OpenAI
- Source: Hacktron AI
- Published Date: 2026-09-13
- Updated Date: None
- Severity: Critical

  • Severity Basis: Researchers achieved RCE on OpenAI Forums via a heap overflow in the HEIF image decoder, chained an over-privileged SSO token, and created a pull request in the internal repository via the employee's ChatGPT/Codex account and connected GitHub.

  • Original Source: Hacking OpenAI

  • Related Sources: SecurityWeek Coverage ,Discourse GHSA-vhm9-85gw-x335

  • Related Entities: CVE-2026-32882, GHSA-vhm9-85gw-x335, libheif, ImageMagick, Discourse, OpenAI SSO, ChatGPT, Codex, GitHub

#

  1. Executive Summary

This vulnerability chain begins with RCE in Discourse’s image-processing environment through a crafted HEIF image. The researchers then used an overprivileged forum SSO token to access an employee’s ChatGPT/Codex account and reached an internal repository through Codex’s GitHub connection.

#

  1. Attack Flow

From Image Upload to Connected GitHub

  1. An attacker uploads a crafted HEIF image to Discourse.
  2. Since FastImage does not support it, it passes through ImageMagick to the vulnerable libheif 1.19.7, leading to RCE via a heap overflow.
  3. The attacker acquires an over-privileged OpenAI SSO token in the compromised forum environment and accesses the forum user's ChatGPT/Codex account.
  4. Via the employee account with GitHub connected, the attacker has Codex create a harmless README change pull request in the internal repository to demonstrate the impact.

Researchers used Claude Opus 4.8 and Claude Opus 5 to develop an exploit for an ASLR-enabled environment, but expert guidance was required; the process was not described as fully autonomous.

#

  1. Attacker Position and Execution Location
  • The starting point is a remote user who can upload images. According to the Discourse advisory, low privileges are required.
  • RCE occurred in the image-processing environment, while subsequent access took place through OpenAI SSO, ChatGPT/Codex, and the GitHub integration.

#

  1. Visibility for Victims and Administrators

Victim : Simply signing in to the forum could make the account a target. There are no clear signs of manipulation. #

Administrator : ImageMagick crashes during HEIF conversion, libheif-related exceptions, abnormal SSO tokens, and unexpected GitHub operations from Codex serve as traces.

#

  1. Success and Failure Conditions

Success Conditions

  • The Discourse environment containing vulnerable libheif can process HEIF/HEIC.
  • The compromised service uses OpenAI SSO, and its token has excessive permissions for the ChatGPT/Codex API.
  • The target account has external services such as GitHub connected.

Failure Conditions

  • Rebuild the Discourse Docker image and apply the patched libheif and image processing sandbox.
  • Limit SSO tokens to minimal scopes per use case and revoke existing tokens and sessions.

#

  1. What Happens Upon Success
  • RCE in the forum environment, takeover of the ChatGPT/Codex account, and operation of connected services become possible.
  • In the demonstration, metadata and commits of the internal GitHub repository were read in a limited manner, and a pull request was created for the README. Actual access to Slack messages was not confirmed.

#

  1. Observable Logs

Email : Check for account notifications or token revocation notifications. #

Proxy / SWG / DNS : Check for image uploads, abnormal communication from the image processing environment, and communication to connected service APIs. #

Endpoint / EDR : Check for ImageMagick process crashes, libheif-related exceptions, abnormal memory access, and shells inside the image processing container. #

Identity / IdP : Check for ChatGPT/Codex API access using forum-use tokens and session reuse. #

SaaS / Cloud : Check Codex operation history, GitHub pull request and metadata reading, and use of connection settings. #

Network : Check for abnormal communication from the image processing layer to the IdP, API, and GitHub.

#

  1. Attack Success Determination

Confirmed in Public Information

Subsequent Compromise Confirmed : Researchers used an OpenAI employee account to create a README change pull request in an internal GitHub repository. OpenAI confirmed limited access to repository metadata and commits, along with pull request creation, and stated that Slack messages were not accessed.

Criteria for Own Organization

Initial Execution Confirmed : Correlate crafted image processing with code execution in the image conversion environment. #

Data Theft or Session Compromise Confirmed : Confirm SSO token acquisition and reuse, and access to other service APIs. #

Subsequent Compromise Confirmed : Confirm actual reads and changes in connection destinations such as GitHub using audit logs.

#

  1. Investigation Playbook

Trigger : Start with HEIF conversion crashes, unpatched Discourse, abnormal SSO scopes, and Codex-derived pull requests. #

Initial Check : Check libheif and Discourse versions, Docker rebuild dates, image uploads, and SSO settings. #

Endpoint : Preserve image processing containers, crashes, shells, and file modifications. #

Authentication / Cloud : Revoke and reissue SSO tokens, all sessions, and connected service permissions. #

Subsequent Operations : Check audit logs for GitHub, Slack, email, etc., per connection unit. #

Containment : Stop and isolate image processing, rebuild Docker, minimize and revoke tokens. #

Determination Categories : Separate image reception, RCE, SSO compromise, and destination access.

#

  1. Defense and Detection Ideas

Single Event : Detect image conversion process crashes, child shells, and mass HEIF submissions. #

Time-Series Correlation : Correlate image uploads, conversion anomalies, SSO usage, Codex operations, and GitHub changes. #

Hunting : Inventory vulnerable libheif, old Discourse Docker, overly broad SSO scopes, and connected high-privilege services. #

Log Deficiency : Without identifiers spanning SSO issuance, API usage, and connector operations, the chain cannot be tracked. #

Priority Countermeasures : Prioritize decoder updates, image processing sandboxing, token least privilege, and re-authentication of connection destinations.

#

  1. Facts / Inference / Hypothesis

Facts

  • The Discourse advisory rated image upload RCE via CVE-2026-32882 as CVSS 8.8 and guided users to patched versions and Docker rebuilds.
  • OpenAI reduced SSO token permissions and revoked affected tokens and sessions.
  • Researchers demonstrated the chain in less than 72 hours and received a $6,500 bounty for the issue on OpenAI's side.

Inference

  • Even low-trust community services can become a path to critical assets if common SSO and high-privilege connectors are present, so trust boundaries must be separated on a per-service basis.

Hypothesis

No additional hypotheses. Unverified items are listed in "Unknowns and Additional Investigation."

#

  1. MITRE ATT&CK Mapping

T1190 Exploit Public-Facing Application (Confidence: high): Exploits image processing vulnerabilities in public forums. #

T1528 Steal Application Access Token (Confidence: high): Obtains OpenAI SSO application access tokens from the compromised forum environment. #

T1550.001 Use Alternate Authentication Material: Application Access Token (Confidence: high): Uses the obtained overprivileged token to access ChatGPT/Codex APIs.

#

  1. Unknowns and Additional Investigation
  • Specific token scopes of the OpenAI SSO issue and all affected services.
  • Presence of exploitation by parties other than the researchers.
  • Range of other libheif-using services where the same chain is established.

#

  1. Impact on SOCs and Organizations

When low-level dependencies like image decoders are chained with SSO, AI agents, and GitHub connectors, a seemingly low-importance forum becomes a pathway to development assets. It is necessary to simultaneously proceed with dependency updates, token usage restrictions, and the minimization of external services that agents can operate.

#

  1. Summary by Target Audience

SOC : Correlate logs from image processing, SSO, Codex, and GitHub by the same user and time. #

Administrator : Rebuild Discourse, update libheif, isolate image processing, minimize SSO scope, and revoke sessions. #

User : Report suspicious account operations or connection changes, and regularly review linked services.

source & further reading
dev.to — original article AI, Financial Market Analysis, and the Search for an Edge Stop Rubber-Stamping "LGTM": Why Pull Requests Are Operational Contracts (Especially with AI Code) Integrity-OS: Promise --> Proof
── more in #ai-safety 4 stories · sorted by recency
── more on @openai 3 stories trending now
sponsored brought to you by zahid.host 4,200+ EU-deployed projects
reading about agents? ship yours in a single git push.

Run your AI side-project on zahid.host

EU-based hosting, git-push deploys, automatic HTTPS, no cold starts. Free tier with a custom domain — perfect for shipping the agent you just read about.

$git push zahid main
→ Live at https://your-agent.zahid.host ✓
Get free account → Pricing
from €0/mo · no card required
LIVE [news/reaching-an-internal…] indexed:0 read:6min 2026-09-19 · —