Researchers have disclosed how a malicious HEIF image uploaded to OpenAI’s public community forum ultimately opened a path to the company’s internal GitHub environment.
Hacktron published the full attack chain on September 13, detailing a July 25 compromise of OpenAI’s Discourse-hosted forum that researchers chained with a separate single sign-on flaw. The group gained access to employee ChatGPT and Codex accounts and used one GitHub-connected Codex instance to create a harmless pull request in OpenAI’s private monorepo.
Hacktron’s technical disclosure says OpenAI fixed the identity-side issue roughly 14 hours after it was reported in July and later awarded the researchers a $6,500 bounty. The newly public technical details show how a flaw in a public-facing file processor can cascade through identity systems and AI-agent integrations into sensitive development infrastructure.
From image upload to internal GitHub
HEIC and HEIF uploads took a different path through Discourse because FastImage did not support the formats. The files instead reached ImageMagick, exposing the underlying libheif parser to attacker-controlled images.
The affected Docker image used Debian 12 with libheif 1.19.7. Hacktron said the package lacked an upstream security fix for a heap-buffer-overflow condition that enabled out-of-bounds read and write primitives during HEIC decoding. The recent FFmpeg PixelSmash vulnerability similarly showed how crafted media files can turn decoder flaws into remote code execution.
A Discourse security advisory tracks the image-upload exposure as CVE-2026-32882 and rates it 8.8 under CVSS. Exploitation requires low privileges and no user interaction. Patched releases include 2026.7.0, 2026.6.1, 2026.5.2, and 2026.1.6.
By July 25, Hacktron said it had achieved remote code execution on OpenAI’s forum and used the separate identity flaw to take over an employee account whose Codex instance was connected to OpenAI’s GitHub organization. Similar token-scope risks have surfaced in recent OAuth token exposure involving another authenticated application.
The researchers instructed Codex to open pull request #1186742 in the private openai/openai monorepo as proof of access, then stopped testing without deliberately viewing internal source code.
Breaking the attack chain
Organizations can contain similar compromises with controls spanning file processing, identity, repository access, monitoring, and incident response:
- Patch and rebuild affected systems. Self-hosted Discourse administrators should use a patched release and rebuild the application. On September 15, Discourse updated its default base image to include libheif 1.23.4 and confirmed that image processing is now sandboxed.
- Restrict and isolate file processing. Allow only required formats, validate file content, disable unnecessary HEIF or AVIF decoding, and process untrusted files in hardened sandboxes. OWASP’s file-upload guidance also recommends allowlists, size limits, and isolated storage.
- Limit parser resources and privileges. Give image decoders minimal filesystem and network access while imposing memory, CPU, file-size, and processing-time limits.
- Narrow SSO and AI-agent permissions. Scope tokens to their intended applications and restrict coding agents to required repositories and actions. Recent OpenAI agent activity involving RubyGems and RubyDoc reinforces the need to limit build-system and credential access.
- Monitor connected systems. Review unexpected pull requests, OAuth events, token use, permission changes, and repository access through GitHub audit logs.
- Test incident response plans. Tabletop exercises should cover compromised applications, SSO sessions, and AI agents, including token revocation, connector isolation, credential rotation, log preservation, and reconstruction of agent activity.
A decoder compromise should stop at the decoder, not cascade through identity systems and AI agents into sensitive development infrastructure.
Also read: For another example of agent containment in practice, see how Anthropic strengthened Claude security after agents accessed live systems.