A hacking group known as HacktronAI says it breached OpenAI’s forum, took over employee accounts, and posted a pull request to OpenAI’s internal codebase and received a $6,500 bounty for doing so. The team discovered a weakness in Discourse, which they then used to infiltrate OpenAI’s infrastructure. They were rewarded for their efforts. The account of the incident, titled “Hacking OpenAI,” has been making the rounds online, and it appears to follow a model of responsible disclosure.
Here’s how it went down.
The Vulnerability Chain
On July 25, 2026, HacktronAI’s team chained two vulnerabilities to break into OpenAI’s systems. They started with administrative access to the Discourse environment at community.openai.com, which runs OpenAI’s help forum. From there, they moved to OpenAI employee accounts, accessed internal repositories, and opened a pull request in OpenAI’s internal monorepo.
The window was narrow. The first sign arrived at 05:00–06:00 UTC. After confirming the cross-product consequences, the team filed a report via OpenAI’s Bug Bounty Program on Bugcrowd at 08:00–10:00 UTC. By 13:30–15:30 UTC, they had created a harmless proof-of-concept pull request in OpenAI’s internal monorepo, amended the Bugcrowd submission, and posted about it on Twitter/X to reach friends at OpenAI. All additional testing ceased around 15:30 UTC.
What the Team Found
The core flaw was a remote code execution (RCE) vulnerability in Discourse’s image-upload pipeline. Discourse normally uses FastImage for image checks, but because FastImage doesn’t support HEIF files, it passes those files to ImageMagick’s magick command for conversion. That exposed the underlying libheif parser directly to attacker-controlled files.
The Opus 4.8 session was initiated by HacktronAI using the Discourse Docker image, and it examined the installed libheif package for security problems. A number of specific security fixes were missing from the package because they had not been back-ported. This omission resulted in a heap buffer overflow, which produced out-of-bounds read and write capabilities during HEIC decoding.
The vulnerable code had been changed upstream the previous year, but the commit wasn’t documented as a security fix and received no CVE. Because Discourse’s Docker image was based on Debian 12, it installed the vulnerable libheif version 1.19.7. Even Debian 13 still ships the vulnerable version 1.1.
The Patch Train
The problem was corrected within roughly 14 hours of the first report. Discourse answered on Sunday, had a solution prepared by Monday, and put image-processing sandboxing in place as an extra layer of protection. The company then posted GHSA-vhm9-85gw-x335 with guidance for applying the patch and rebuilding.
The HacktronAI team first notified OpenAI and Discourse about the vulnerability, then collaborated with both companies to coordinate a patch. The team thanked OpenAI and Discourse for their careful attention and prompt resolution. OpenAI also paid the $6,500 bounty.
How the Disclosure Played Out
The team worked with care and deliberation. They reported to Bugcrowd, submitted to Discourse via its HackerOne program, and kept all parties informed throughout. They crafted a harmless proof-of-concept pull request to demonstrate the practical effect without gaining access to any sensitive data.
An employee’s Codex account was used to open the pull request. The team had the means to do much more with it — they could have connected to GitHub, Slack, and emails through the compromised accounts. Instead, they chose to show the access and then stop.
Why This Matters
A vast amount of material lay within reach. Since individuals may join numerous systems to Codex and ChatGPT, the exposure covered GitHub, Slack, and emails. Rather than press those openings, the team elected a different course. Their purpose was merely to establish that such access was possible, not to put it into service.
The sequence of events moved quickly. From the first finding of the flaw through gaining access to the OpenAI codebase, the whole process unfolded in under 72 hours. The pace shows how seriously the weakness was treated by those working on it.
The HEIF Heist
HacktronAI’s research didn’t stop at OpenAI. The group has since expanded the investigation into HEIF Heist, a multi-month project tracing libheif across Slack, Meta, GitHub Enterprise, Ruby on Rails, and Node.js frameworks such as Next.js, Astro, and Gatsby. A surprising amount of widely-used software depends on this one image-processing library.
The HacktronAI team has issued an alert for applications that handle user-supplied images and accept .heic/.heif/.avif files, saying they are probably affected by the issue. Anyone seeking help is encouraged to get in touch at hello@hacktron.ai.
The Patch Notice
Self-hosted Discourse users should act quickly and rebuild their installations. Some older Docker images carry a vulnerable libheif dependency that allows code execution after an image upload. The fix involves running git pull then ./launcher rebuild app from /var/discourse. A mere web-interface update will not suffice to change the underlying image. Discourse-hosted customers have already received the patch.
OpenAI uses Discourse for its forum and allows “Sign in with OpenAI” through auth.openai.com. Compromising the forum creates a path into broader OpenAI services through that identity flow.
The Takeaway
The team identified a vulnerability, reported it, worked alongside both vendors to coordinate a fix, and earned a bounty for their efforts. They demonstrated proof of the access without actually exploiting it, and halted their testing once they had established enough evidence.
That the vulnerability chain touched two separate platforms — Discourse and OpenAI’s own systems — demonstrates how tightly bound modern software stacks now are. A single library defect can spread across many applications.
The absence of a CVE for the upstream fix stands out. It points to a systemic issue in how patches are documented and tracked, one that the team’s note about Debian 12 and 13 not receiving security relevant backports in time suggests the problem isn’, which includes OpenAI’s fault. It’, has encountered.
Both vendors were informed about the problem by the team, which then worked with them through the whole process. The $6,500 bounty serves as a reward for such responsible reporting.
This account serves as a reminder that security researchers rely on trust in their work. They discover vulnerabilities, disclose them, and frequently surrender access to the systems they’ve uncovered. This particular group followed that course, and they were compensated for it.
Key Facts Box
– Date: July 25, 2026
– Vulnerability chain: Discourse RCE → OpenAI employee accounts → OpenAI internal repo access
– Timeline: <72 hours from discovery to OpenAI repo access
– Bugcrowd submission: 08:00–10:00 UTC (July 25)
– OpenAI-Side fix confirmed: 22:49:45 UTC
– Bounty: $6,500 from OpenAI
– Advisory: GHSA-vhm9-85gw-x335 published by Discourse
The group is led by Harsh Jaiswal, with Mohan Pedhapati and Rahul Maini also part of it.
The software at risk here is a library whose job is to handle image files, and two specific versions of it have been found to be weak. The older version is 1.19.7, which is used in Debian 12, while the newer one is 1.1, found in Debian 13. Both of these versions share the same weakness. The platforms affected run the full range from forum software to chat apps to code hosting, including Discourse, Slack, Meta, GitHub Enterprise, Ruby on Rails, Node.js (Next.js, Astro, Gatsby).
Self-hosted users need to run two commands to update their system. First, execute git pull. Then, from the /var/discourse directory, run ./launcher rebuild app.
Every party came out ahead. The company behind the AI received a correction, the scientists behind it were compensated, and people across the web found out about a common problem in a well-used software package. This is precisely what a careful approach to revealing weaknesses is meant to achieve.
Source material: “Hacking OpenAI,” hacktron.ai.
Get the Notebook.
The day's best stories and every fresh verdict, in plain English, in your inbox by seven. One email a day, no more.