On 25 July 2026 a three-person research team took over OpenAI employees’ ChatGPT and Codex accounts, and from there reached internal repositories. Discovery to demonstrated repo access took under 72 hours, and neither of the two vulnerabilities involved is exotic.

The chain:

  • A heap buffer overflow in libheif, reached through ImageMagick, reached through a HEIC upload on community.openai.com
  • Remote code execution on the Discourse forum
  • A flaw in OpenAI’s single sign-on turned that forum into a path into ChatGPT and Codex accounts
  • Those accounts had GitHub connected, which meant internal repositories

The first half is the transferable bug:

  • Discourse passed HEIC/HEIF files to ImageMagick’s magick command, because FastImage did not support the format. That exposed the libheif parser directly to user-controlled files.
  • The fix had landed upstream a year earlier, but the commit was not documented as a security fix and received no CVE — so Debian 12 and 13 never got the backport. The forum’s container ran Debian 12 with the vulnerable libheif 1.19.7.
  • Nobody did anything wrong in the ordinary sense. The fix existed, and the container still shipped the bug, because downstream had no signal that it mattered.

The second half is the architectural one:

  • The forum RCE was only valuable because “Sign in with OpenAI” existed. Any first- or third-party service sharing that identity provider would have given the same access; Discourse was just one door.
  • Blast radius came from the integrations on the account, not from the compromised app. To prove access without reading any internal code, the team prompted the hijacked account’s Codex to open a pull request in OpenAI’s monorepo, then stopped testing.

Disclosure was fast on both sides: reported to OpenAI through Bugcrowd within hours, fix confirmed about fourteen hours after submission, $6,500 bounty. Discourse replied to a Saturday report on Sunday and had a fix by Monday, plus sandboxing of ImageMagick as defence in depth.

The cost figures from their wider campaign are the part that should change threat models. Two months of research across Slack, Meta, GitHub Enterprise, Rails and several Node frameworks, under $3,000 in tokens, three people, with one to two days to adapt the exploit to each new target — usually without knowing the target’s exact library versions or deployment environment. Nobody they are aware of detected it except Shopify, “even after thousands of images were sent and their image processors repeatedly crashed.”

If you run anything that accepts user-uploaded images, the actionable part is small: check your libheif and libde265 packages through the distribution security channel and read the advisory rather than the version number, disable untrusted HEIF/AVIF decoding where it is not needed, or push image processing into a hardened ephemeral sandbox. Self-hosted Discourse needs a rebuild, not a web update, because older Docker images keep the vulnerable library.

Their closing argument is worth sitting with. Exploitability used to be gated by scarce expertise, which was never a real security boundary but did protect ordinary companies in practice. Converting that expertise into compute removes the protection without removing any bug, which makes “nobody would bother attacking us” a worse assumption than it was last year.