Breach Report: Compromising OpenAI Internal Repositories via Heap Overflow and SSO Flaws

---

Authors: Harsh Jaiswal, Mohan Pedhapati, and Rahul Maini
Date: September 13, 2026
Reading Time: $\approx 11$ minutes

1. Introduction

On July 25, 2026, the Hacktron AI team successfully executed a chain of two critical security vulnerabilities. This sequence allowed us to hijack the ChatGPT accounts of several OpenAI staff members, which subsequently granted us entry into OpenAI's internal code repositories and other integrated services.

To validate the breach without compromising sensitive data, we utilized an employee's Codex access to submit a benign pull request—PR #1186742—directly into the internal monorepo located at openai/openai.

The Attack Vector Logic

The vulnerability chain can be visualized as follows:

Until recently, any individual—including OpenAI employees—logging into the help forum (community.openai.com) was susceptible to this account takeover. Because Codex and ChatGPT often link to external productivity tools, the potential blast radius included everything GitHub, Slack, and corporate emails.

The entire operation, from the first discovery to accessing the internal monorepo, was completed in under 72 hours.

---

2. Incident Timeline

The following table outlines the rapid progression of the exploit and the subsequent remediation process.

---

3. Technical Background

The Hacktron team, led by Harsh Jaiswal, Mohan Pedhapati, and Rahul Maini, began auditing frontier AI firms for security gaps. This effort uncovered an SSO misconfiguration in OpenAI's identity layer and a remote code execution (RCE) flaw in the libheif library used by their community forum.

This discovery evolved into a broader study called "HEIF Heist," where we tracked libheif across various major platforms:

• Communication: Slack, Meta.
• Development: GitHub Enterprise.
• Frameworks: Ruby on Rails, Node.js (Next.js, Astro, Gatsby).

The Mathematics of the Overflow

The vulnerability is essentially a heap buffer overflow. In simple terms, if the allocated memory $M_{alloc}$ is smaller than the incoming data $D_{input}$: $\text{If } D_{input} > M_{alloc} \implies \text{Memory Corruption / Overflow}$

If your application accepts .heic, .heif, or .avif files, you are likely vulnerable.

---

4. Hacking community.openai.com

[!WARNING] Patch Notice for Discourse Self-Hoster: If you host your own Discourse instance, you must rebuild it immediately. Standard web-interface updates may not replace the vulnerable libheif dependency.

To fix this, execute the following commands in your terminal:

cd /var/discourse
git pull
./launcher rebuild app

The Strategy

OpenAI utilizes Discourse for its community forum and implements "Sign in with OpenAI" via auth.openai.com. We hypothesized that gaining RCE on the forum could provide a pivot point into the broader OpenAI identity ecosystem.

While the Discourse application is generally robust, we targeted its dependencies. On July 23, we analyzed the image-upload pipeline and identified a heap buffer overflow in libheif when processing HEIC/HEIF images.

Visual Evidence

Below are the profiles of the researchers involved in the discovery:

---

5. Resolution and Rewards

OpenAI responded quickly, patching the flaw within 14 hours of the report. Regarding the financial reward, OpenAI provided the following clarification:

"To clarify the scope of that award: testing against the Discourse-hosted community.openai.com was explicitly excluded from our bug bounty program. The award recognizes the OpenAI-side finding, not the actions against Discourse."

Final Remediation Checklist

• Patch libheif dependency.
• Fix SSO identity misconfiguration.
• Implement image-processing sandboxing (Discourse).
• Rotate affected internal credentials.

For those needing assistance with libheif vulnerabilities, please contact the team at hello@hacktron.ai.