GoKawiilResearchers chained two bugs to hijack OpenAI staff ChatGPT and Codex accounts
Security researchers at HacktronAI combined a flaw in the libheif image decoder used by ImageMagick with an SSO identity issue on OpenAI's Discourse-based community forum to gain remote code execution and admin access on community.openai.com. Using that foothold, they took over multiple OpenAI employees' ChatGPT and Codex accounts and, to prove access without touching sensitive data, opened a pull request in OpenAI's internal monorepo. The whole process from discovery to internal repo access took under 72 hours.
GoKawiil's interpretation of the reporting above, not reported fact.
Because ChatGPT and Codex accounts can be linked to GitHub, Slack, email and other connectors, a single forum-login flaw could have exposed a wide swath of OpenAI's internal infrastructure to attackers. The case shows how a seemingly minor image-library patching gap can cascade into enterprise-wide account takeover when identity systems are shared across products.
- Two chained bugs, an unpatched libheif flaw and an SSO identity flaw, enabled full account takeover on OpenAI's forum.
- Attackers used compromised employee Codex access to open a verified pull request in OpenAI's internal repo as proof.
- OpenAI patched the issues quickly after disclosure and paid a $6,500 bug bounty.
YubiKey 5C NFC Security Key — This story is a stark reminder of how account takeovers can cascade from a single SSO flaw into deep organizational access. A hardware security key like the YubiKey adds a strong phishing-resistant second factor to logins, making the kind of identity-based exploit chain described here far harder to pull off.
See YubiKey 5C NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: hacktron.ai, 2026-09-18
Published there as: “Hacking OpenAI”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.