A devastating vulnerability in OpenAI’s sign-in system has been exposed, allowing hackers to gain access to employee ChatGPT and Codex accounts. The exploit was built using AI-powered tools and exploited a flaw in an image-processing library used by Discourse, the platform hosting OpenAI’s community forum.
Hacktron, a security firm, discovered that uploading HEIC/HEIF photo files to OpenAI’s community forum exposed a vulnerability in the libheif library used by ImageMagick. The underlying bug had been fixed upstream over a year ago, but it was never assigned a CVE or patched properly. This oversight allowed Hacktron to turn the flaw into a reliable exploit using Claude Opus 4.8 and Opus 5.
The researchers first tested their exploit on a test Discourse instance before successfully chaining it with the sign-in system vulnerability on OpenAI’s own forum. Since users can log in to the community forum using their OpenAI account, this opened a path for hackers to access broader account information. Until the issue was fixed, any user or employee who logged into the forum could have had their ChatGPT and Codex accounts taken over.
The potential impact of this vulnerability is alarming, as users often connect other services to these accounts, exposing them to additional risks. In theory, hackers could gain access to GitHub, Slack, and email accounts linked to OpenAI’s community forum.
OpenAI has confirmed that the two vulnerabilities are separate issues. The company distinguished between the image-processing bug, which lived in the third-party service Discourse, and the account-takeover issue on its own sign-in system. It appears that the sign-in tokens generated for the community forum carried excessive permissions, granting full API access to associated ChatGPT and Codex accounts.
To demonstrate the severity of this vulnerability, Hacktron took over an OpenAI employee’s account whose Codex integration was linked to OpenAI’s GitHub organization. They then used it to open a pull request in an internal repository before stopping further testing. While OpenAI claims that only private-repository metadata and commits were accessed, the security firm’s report raises concerns about potential access to Slack messages.
In response to Hacktron’s report, OpenAI confirmed a fix for the account-takeover issue within 14 hours of being notified through Bugcrowd. The company also reported the libheif flaw to Discourse through HackerOne, and a patch was ready within two days. As an added layer of defense, Discourse implemented image-processing sandboxing.
While this vulnerability has been fixed, it serves as a stark reminder of the potential risks associated with AI-powered exploits and the importance of timely patching and vulnerability disclosure. In light of this incident, users are advised to regularly review their account permissions and connected services to minimize exposure to potential threats.
Source: SecurityWeek — 2026-09-18