How did the researchers breach OpenAI's internal repository?

A combination of two vectors: On the supply chain side, community.openai.com runs on Discourse, where user images are processed by ImageMagick calling libheif for decoding. Researchers claim Debian did not backport security patches for this library to the old version in use, leaving a heap overflow in the system; a crafted image could achieve remote code execution. On the identity side, there was a configuration error in the "Sign in with OpenAI" flow at auth.openai.com. Researchers used this to take over multiple employees' ChatGPT accounts, leveraging employee identities to gain access to the internal monorepo.

What is the timeline of the incident?

July 23, Hacktron began reviewing the attack surface; July 25, completed the intrusion demo and submitted the report the same day, OpenAI confirmed the fix about 14 hours later; July 26, reported to Discourse via HackerOne; July 28, Discourse released advisory GHSA-vhm9-85gw-x335 with patches and rebuild instructions; September 1, OpenAI paid $6,500 bounty and marked it resolved, while clarifying that testing on the forum side was out of scope; September 13, blog post went public, September 18, hit HN (468 points, 197 comments).

Why did the $6,500 bounty spark controversy?

HN commenter rvz believed the amount was clearly mismatched with the severity of the vulnerability combination; kerenskiy analogized the black market price to the multi-million dollar level (pure speculation without market data); samtheprogram thought the real meaning of this money was the pricing for a vulnerability covering the account and all connected integrations; others (tptacek) believed such vulnerabilities likely don't exist on the black market and "mismatch" is a false proposition. Another calculation is the disclosure clock: users were unaware during the nearly two-month interval, while the public disclosure clock is controlled by the vendor.

Two Vulnerabilities Breach OpenAI Internal Repo: Image Decoding Library + SSO Misconfiguration, $6,500 Bounty

Hotspot Tracking: Hotspot Release × Technical Judgment × Practical Advice. Author: Yongliang

Let’s separate the two dates first. On September 13, the security team Hacktron published a long blog post authored by Harsh Jaiswal, Mohan Pedhapati, and Rahul Maini, detailing a complete intrusion demonstration they completed on July 25: a combination of two vulnerabilities that started from an image on the OpenAI community forum and led all the way to OpenAI’s internal code repository. The article received little attention on the day of its release; the real ferment happened on September 18—when the post hit the Hacker News front page with 468 points and 197 comments (data as of the morning of September 19). The attack technique itself didn’t make much of a splash in the comments section; what everyone argued about was the number at the end: the $6,500 bounty. This issue will lay out the facts by timeline and then break it down into three layers.

What Happened

Laying out the facts by timeline, entirely based on the account from Hacktron’s article.

On July 23, Hacktron began reviewing OpenAI’s attack surface. On July 25, the combination of two vulnerabilities was in place, the intrusion demonstration was completed, and the report was submitted that same day; about 14 hours later, OpenAI confirmed the fix. On July 26, the team synchronized the forum-side issue to Discourse officials via HackerOne and received a reply by Sunday. On July 27, Discourse’s fix was ready, and sandboxing was added to the image processing process for defense-in-depth. On July 28, Discourse released a security advisory, numbered GHSA-vhm9-85gw-x335, accompanied by patches and rebuild instructions. On September 1, OpenAI paid a $6,500 bounty and marked the report as resolved—while also clarifying a point: testing against community.openai.com hosted by Discourse was not within the scope of their bounty program, and the bounty only recognized discoveries on the OpenAI side.

From the incident in July to the public disclosure on September 13, there was a gap of nearly two months. This interval itself will be calculated separately later.

How the Two Vulnerabilities Combined

The first line: the supply chain. libheif is an open-source decoding library for processing HEIF/HEIC images. According to the researchers, Debian did not backport the security patches for this library to the old version in use, so the vulnerability remained in the system for a long time. The OpenAI community forum, community.openai.com, is built on Discourse. User-uploaded images go through ImageMagick, which calls libheif for decoding—and the heap overflow was hidden right here. Upload a carefully crafted image, and you have remote code execution on the forum server.

The second line: identity. OpenAI’s own identity infrastructure had a configuration error located in the “Sign in with OpenAI” login flow at auth.openai.com. Researchers exploited this error to take over the ChatGPT accounts of multiple employees, and then followed the employee identity trail to gain access to the internal monorepo (openai/openai). Combine the two lines: breach the server from the forum’s image upload point, then cross into the internal repository via employee identity—a complete deep penetration.

There is another detail worth recording separately. To prove they really reached the internal repository without seeing sensitive data, researchers used one of the employees’ Codex to open a PR in the internal repository, numbered #1186742. Using the victim’s AI coding tool to leave a note in the victim’s internal repository—this method of self-proof is the most visual scene in the whole incident, and it also makes the issue of “AI tools carrying the owner’s permissions by default” concrete.

The Calm Other Half: Three-Layer Audit

First, a statement of position: In this incident, the fix speed was impeccable—fix confirmed about 14 hours after reporting, and Discourse took two days from report to advisory. Both responses were fast. What really begs the question lies elsewhere, divided into three layers.

Layer 1, Supply Chain. A missing backport for an image decoding library led all the way to employee accounts at a frontier AI company. Supply chain security has been talked about for years, but when things really go wrong, it’s often not where you’re focusing your defense, but on an image decoding path. “Edge systems” like community forums never have the same level of security budget as core systems, but because they connect to employee identities, they become a side door next to the main entrance. If the side door isn’t locked, it doesn’t matter how thick the main door is.

Layer 2, Identity Layer. An SSO configuration error amplified a forum-level code execution into internal repository access. How much is an SSO configuration worth? You can’t tell usually, but it becomes fully apparent when one incident happens. Identity management has been one of the fastest-growing areas of security investment in recent years, but configuration errors are precisely the category that relies least on purchasing and most on process discipline—no matter how complete your tools are, one wrong process configuration zeroes out everything before it.

Layer 3, Bounty and Disclosure. There are two calculations here. The first is the disclosure clock: the incident happened in July, disclosure in September, nearly two months of interval where users knew nothing, while the public disclosure clock is in the vendor’s hands. Researchers have to wait for the bounty process to finish and have no channel to advocate for users’ right to know. The second is the price itself. In the HN comments, commenter rvz believed that $6,500 was clearly mismatched with the severity of this vulnerability combination; commenter kerenskiy analogized the black market price to the multi-million dollar level—it must be made clear that this is pure speculation without any market data support; commenter samtheprogram’s interpretation was colder: the real meaning of this money is the price OpenAI sets for a vulnerability that can cover your account and all connected integrations; commenter fancythat stated bluntly that bounty hunters should save their energy for clients who understand security and can pay. The opposing voice was also present: netizen tptacek believed that such vulnerabilities likely don’t exist on the black market, and “mismatch” is a false proposition. And the sharpest comment came from muglug: let’s hope the model weights are better protected than this.

There is another statement worth recording separately. When OpenAI paid the bounty, they clarified that testing against community.openai.com hosted by Discourse was not within the scope of the bounty program, and the bounty only recognized OpenAI-side discoveries. Forum code execution doesn’t count because it runs on third-party software—where this “exclusion” boundary is drawn, who draws it, and who bears the loss of community users after it’s drawn is more worth discussing than the number 6500 itself.

Worth Noting

First, the scope of HEIF Heist. Hacktron expanded this investigation into a project lasting over a month, codenamed HEIF Heist. Researchers claim that the scope of libheif goes far beyond OpenAI: Slack, Meta, GitHub Enterprise, Ruby on Rails, as well as Node frameworks like Next.js, Astro, and Gatsby are all on the list. This is currently entirely researchers’ self-reporting, without independent verification, and the involved vendors have not yet confirmed them one by one.

Second, OpenAI’s official stance. As of publication, OpenAI has not released a public security advisory regarding this matter. All information currently visible comes from Hacktron’s unilateral disclosure plus a bounty payment record. How many employee accounts were specifically involved and what scope of the repository was accessed are all based on researchers’ self-reports; this must be kept in mind when reading any second-hand retelling.

Third, Discourse’s “rebuild” guidance. The advisory GHSA-vhm9-85gw-x335 offers affected sites a solution of patches plus rebuild instructions, using the word “rebuild”. Teams running self-hosted Discourse take note: upgrading the interface is not equivalent to a fix; this point is worth copying directly into your operations checklist.

Conclusion

The real reminder from this incident comes in two halves. For platforms: the image upload path is the lowest-key entry among high-risk surfaces, and identity configuration is the most expensive screw—if the side door isn’t locked, it doesn’t matter how thick the main door is. For ordinary teams: self-hosted Discourse needs a rebuild, not just an interface upgrade; image decoding dependencies need to be watched for backports; don’t wait for advisories to knock on your door. As for the pricing logic of $6,500, OpenAI doesn’t need to explain it to anyone; but the next time a researcher combines two vulnerabilities to breach a frontier company’s internal repository, the quote sheet will likely be placed on the negotiation table first.

References

Hacktron security team long blog post (2026-09-13, authors Harsh Jaiswal, Mohan Pedhapati, Rahul Maini): Attack chain, response timeline, bounty and scope statements, HEIF Heist project statement—all based on researchers’ self-reported accounts.
Hacker News discussion thread (Hit front page on 2026-09-18, 468 points, 197 comments, data morning of 2026-09-19): Comment section views are personal opinions of commenters; the main text has been fully retold and attributed; the black market price analogy has been marked as pure speculation.
Discourse security advisory GHSA-vhm9-85gw-x335 (2026-07-28): Patches and rebuild instructions.