OpenAI Forum Exploit Reached Employee Codex and an Internal Repository: Patch the Discourse HEIF RCE

By AiCybr Editorial · Published September 19, 2026

Security researchers at Hacktron chained a remote-code-execution flaw in the image-processing path of OpenAI's Discourse forum with an OpenAI sign-in weakness, gaining access to employee ChatGPT and Codex accounts and demonstrating access to an internal GitHub repository. The research was conducted in July and publicly detailed in September 2026.

The Discourse side of the chain is now tracked as GHSA-vhm9-85gw-x335 and CVE-2026-32882, with a CVSS 8.8 High rating. Discourse lists 2026.7.0, 2026.6.1, 2026.5.2 and 2026.1.6 as patched releases and instructs Docker-based operators to rebuild the application so the updated libheif reaches the running image.

The incident matters beyond one forum. It combined a vulnerable native image decoder, a public upload surface, federated identity and a developer account connected to additional services. That trust chain allowed compromise of a peripheral community service to progress into a high-value development environment.

The attack path

OpenAI's community forum runs on Discourse. According to Hacktron's disclosure and independent reporting, HEIC/HEIF uploads reached an image-processing stack that included ImageMagick and a vulnerable libheif build. The researchers developed a working exploit for the memory-corruption flaw and obtained remote code execution on the forum environment.

Discourse's security advisory confirms the product-level issue: an upstream libheif vulnerability, CVE-2026-32882, allowed remote code execution through Discourse image uploads. The advisory rates the issue 8.8 under CVSS 3.1, with network attack vector, low complexity, low privileges and no user interaction after the upload path is reached.

The next step crossed an identity boundary. Reporting based on Hacktron's disclosure says the researchers found an OpenAI sign-in weakness that let access from the compromised forum environment extend to linked ChatGPT and Codex accounts. They took over an OpenAI employee account whose Codex environment was connected to OpenAI's GitHub organization.

To demonstrate impact while limiting access to sensitive material, the researchers instructed the compromised Codex account to open a harmless pull request in OpenAI's internal monorepo, then stopped testing and reported the findings. OpenAI told reporters that it addressed the vulnerabilities and thanked the researchers. The company paid a $6,500 bug bounty for the OpenAI-side finding; testing against the Discourse-hosted community forum itself was outside the stated OpenAI bounty scope.

Claude accelerated exploit development

The research also provides a concrete example of AI-assisted vulnerability research compressing exploit-development time.

Hacktron initially used a cybersecurity-access version of Anthropic's Claude Opus 4.8, which reportedly failed across several sessions to produce a working exploit for the image-processing flaw. After Claude Opus 5 became available, the researchers gave the newer model the same problem and obtained a working result within hours. The complete research path from initial investigation to demonstrated internal-repository access took less than 72 hours, according to the researchers.

That timeline is evidence from one authorized research engagement, rather than a general benchmark for autonomous offensive capability. Skilled researchers selected the target, interpreted results, chained the vulnerabilities and controlled the scope. The useful operational signal is narrower: stronger coding and reasoning models can materially reduce the labor required to turn a memory-safety bug into a working exploit.

Discourse versions that close the HEIF RCE

Discourse's advisory provides a direct remediation matrix:

The advisory says the latest Discourse Docker image contains the patched libheif and directs operators to update through a normal application rebuild:

cd /var/discourse
./launcher rebuild app

For containerized deployments, the rebuild is material because the vulnerable component lives in the image's native dependency stack. Updating application code without replacing the underlying image can leave an old decoder in service.

Discourse also added image-processing sandboxing as defense in depth. Native media parsers routinely process attacker-controlled binary formats, so isolating those processes reduces the privilege and filesystem/network reach available if a future decoder defect survives dependency patching.

What self-hosted operators should check

Operators running Discourse should first identify the deployed release and rebuild onto the patched version for their maintained branch. The running container or image should then be checked to ensure it actually contains the updated libheif, especially where application updates and base-image rebuilds are managed separately.

The incident also supports a broader review for services that accept HEIC, HEIF or related image formats through native decoding libraries. Inventorying transitive media-processing dependencies is useful because a web application may invoke libheif indirectly through ImageMagick or another conversion layer.

Identity architecture deserves the same attention. Community forums, support portals, documentation systems and other lower-trust applications should receive tokens scoped only to the service functions they require. A compromise of one relying party should have a bounded path into employee AI tools, source repositories, email, storage and administrative APIs.

For high-value developer identities, review OAuth and SSO scopes, connected applications, long-lived sessions and repository permissions. Separate accounts or tightly scoped credentials for public community systems can reduce the blast radius of a compromised web service.

Why the chain is more important than either bug alone

The Discourse RCE had a clear product fix, while the OpenAI identity weakness was an organization-specific trust problem. Their combination produced the consequential outcome.

This is a common pattern in modern developer infrastructure. A public-facing service may have modest direct value but share identity, browser sessions, OAuth grants or connected developer tooling with systems that hold source code and production credentials. Security reviews that stop at the first application's data boundary can miss the effective privilege created by those connections.

AI coding agents add another link because they can act through repository integrations on behalf of an authenticated user. The appropriate control is conventional least privilege: constrain the identity, repository and tool permissions available to the agent so a stolen session cannot automatically inherit broad development access.

Bottom line

Self-hosted Discourse installations should run 2026.7.0, 2026.6.1, 2026.5.2, 2026.1.6 or a later supported release, according to the branch in use, and Docker deployments should rebuild the application image to pick up the patched libheif.

The OpenAI incident also shows why public community systems should be treated as separate trust zones from employee AI and development environments. Patch native upload processors, sandbox media decoding, minimize SSO/OAuth scope and keep developer-tool integrations behind identities whose compromise has a deliberately limited blast radius.

Sources

• Discourse security advisory, GHSA-vhm9-85gw-x335 / CVE-2026-32882, published July 28, 2026.
• Hacktron security research disclosure on the OpenAI investigation, publicly discussed in September 2026.
• TechCrunch, Researchers used Anthropic's Claude to hack into OpenAI, September 18, 2026.
• The Register, Researchers used Claude to hack OpenAI employees' ChatGPT accounts, September 18, 2026.
• SecurityWeek, AI-Built Exploit and Sign-In Flaw Opened Path to Internal OpenAI Code, September 18, 2026.