Security researchers at Hacktron said they combined a vulnerability in a public OpenAI community forum with an identity-management weakness to access the ChatGPT and Codex accounts of several OpenAI employees. The company reportedly remediated the OpenAI-side issue and awarded the researchers a $6,500 bug bounty.
The activity was presented as authorized security research rather than an active compromise. Hacktron said it demonstrated the impact by triggering a single harmless pull request through an employee-linked Codex connection, then ended testing. The team said it did not review source code, alter repositories, access customer information, or use potential access to other connected services.
Forum compromise and shared sign-on
The initial foothold involved Discourse forum software processing HEIC or HEIF image uploads with ImageMagick and the libheif library. The researchers cited CVE-2026-32882, a libheif memory-safety issue fixed upstream in version 1.22.0. Public vulnerability records characterize the flaw as an out-of-bounds read that may cause crashes or disclose memory; Hacktron said it combined related memory bugs to achieve code execution on the forum host.
According to the researchers, the more consequential issue was that the forum supported the same OpenAI single sign-on system used for other services. Control of the forum environment allegedly allowed access to accounts belonging to OpenAI staff who had forum accounts, without requiring those users to interact with an attacker.
OpenAI has not publicly released technical details of the reported identity flaw. Hacktron said OpenAI confirmed the report through its remediation and bounty payment, while noting that the bounty covered the OpenAI-side finding rather than testing of Discourse itself.
AI-assisted exploit development
Hacktron said it used Anthropic's Claude Opus 5 to help develop the exploit after an earlier model struggled with protections such as address space layout randomization. The group said human researchers directed the work throughout and described the model's contribution as accelerating, rather than fully automating, exploitation.
The report highlights risks associated with unpatched media-processing dependencies and broadly trusted single sign-on relationships. Organizations using libheif for untrusted HEIF, HEIC, or AVIF files should apply vendor or distribution updates, consider sandboxing image processing, and disable unnecessary format support. Security teams should also limit which lower-trust services can inherit access through shared identity sessions and require renewed authentication for sensitive actions.
Hacktron said there is no evidence that the reported OpenAI weakness was exploited outside its research. Some broader claims tied to the group's related testing campaign have not been independently confirmed.