The Pulse
Researchers Used OpenAI’s Codex to Open a Monorepo Pull Request
Hacktron researchers say a vulnerable image-processing path and an OpenAI SSO flaw let them reach an employee’s Codex account and create a pull request in OpenAI’s internal monorepo.
AI.info Team ·
A three-day path into OpenAI’s code infrastructure
Hacktron researchers say they reached OpenAI’s internal monorepo in less than 72 hours after finding a route from the company’s public help forum into employee ChatGPT and Codex accounts. The researchers did not read internal source code, they say. Instead, they used an employee’s Codex account to open pull request 1186742 in OpenAI’s private openai/openai repository as proof that the account had access.
Hacktron’s timeline says the path from initial discovery to access to OpenAI’s repository took less than 72 hours.
The disclosure describes an attack chain that began with a memory-safety flaw in libheif, an image-processing library used through ImageMagick in the Discourse software running at community.openai.com. Hacktron says the chain reached OpenAI’s single sign-on system, then ChatGPT, Codex and a connected GitHub organization.
The researchers say OpenAI fixed its side of the issue roughly 14 hours after receiving the report on July 25. OpenAI paid a $6,500 bounty on September 1 and marked the report resolved. The award covered the OpenAI-side finding, while testing against the Discourse-hosted forum was excluded from OpenAI’s bug-bounty program.
NeshDevTech labels its item “Hacker News” and links to the full article on Hacktron’s website. The pull request link was redacted at OpenAI’s request, so the public record does not show the repository contents or the exact change submitted.
Image uploads became the first access point
Hacktron says its investigation began on July 23, when the team examined how Discourse handled HEIC and HEIF image uploads. Because the normal image-checking path did not support those formats, the files were passed to ImageMagick for conversion, exposing the libheif parser to attacker-controlled input.
The researchers found that security changes in the upstream code had not been back-ported into the package used by the Discourse deployment. They describe the flaw as a heap buffer overflow that could provide out-of-bounds read and write access during HEIC decoding. The report says the affected Discourse image used Debian 12 and carried libheif version 1.19.7 at the time.
Hacktron says the code change that addressed the vulnerable behavior had been made upstream the previous year but had not been identified as a security fix and had not received a CVE. The researchers later reported the issue to Discourse through HackerOne. Discourse responded on July 26, had a fix ready by July 27 and published an advisory on July 28, according to the timeline in the disclosure.
The advisory linked from the report, GHSA-vhm9-85gw-x335, includes patch and rebuild guidance for affected installations. Hacktron says Discourse also began sandboxing ImageMagick as an additional containment measure.
Claude helped turn the flaw into working code
The researchers used Anthropic’s Claude models during the exploit development process. Hacktron says Claude Opus 4.8 helped identify the missing security backports and produce an exploit under simplified local conditions, but several attempts failed when address-space layout randomization was enabled in the target configuration.
After Anthropic released Claude Opus 5, Hacktron says a new session produced a working exploit for an ARM64 Mac within three hours. The team then adapted it to the x86-64 environment and memory allocator used by Discourse. By 6 a.m. UTC on July 25, the researchers say they had confirmed local remote code execution through an image upload.
Hacktron then placed the model in an autonomous goal loop against a Discourse Cloud instance configured as a controlled target. When the researchers checked again at 10 a.m. UTC, the agent had achieved remote code execution on Discourse Cloud and demonstrated access by reading /etc/hosts. The team then used the generated exploit against OpenAI’s forum instance, according to the disclosure.
The report does not describe the process as fully autonomous. Hacktron says skilled human guidance was still required, while the models reduced the time needed to adapt the exploit to a new environment.
The SSO weakness widened the blast radius
Remote code execution on the forum was only the first step. Hacktron says OpenAI’s “Sign in with OpenAI” flow created a path from the compromised Discourse environment into ChatGPT and Codex accounts. The researchers say active forum users, including OpenAI employees, could have had those accounts taken over before the fix.
One compromised employee account had Codex connected to OpenAI’s GitHub organization. Hacktron says the researchers sent a prompt through that account instructing Codex to open a pull request in the internal monorepo. They stopped testing after creating the proof of access and did not inspect internal code.
The disclosure frames the SSO configuration as the OpenAI-specific escalation flaw. Discourse was the route used to demonstrate it, but Hacktron says a compromise of another first-party or third-party OpenAI service using the same identity system could have produced a similar path into ChatGPT and Codex.
The report also says the original timeline from discovery to repository access was under 72 hours. The researchers submitted their initial report through OpenAI’s Bugcrowd program between 8 a.m. and 10 a.m. UTC on July 25, then updated the submission with the account-access and pull-request proof later that day.
What the incident establishes—and what it does not
The public evidence establishes that Hacktron says it obtained access sufficient to create a pull request in OpenAI’s internal repository. It does not establish that the researchers copied OpenAI source code, accessed model weights, altered production systems or reached every connected service named in the report.
Hacktron says the potential scope included GitHub, Slack and email because users can connect services to ChatGPT and Codex. That is a description of possible reach, not a claim that the researchers accessed each service. The disclosure says the team stopped after the proof-of-concept pull request and did not continue testing.
The report places the incident inside a broader project examining libheif across software used by Slack, Meta, GitHub Enterprise, Ruby on Rails and several Node.js frameworks. Hacktron says the wider project involved three researchers, lasted two months and cost less than $3,000 in model tokens.
For defenders, the immediate issue is narrower than the broader claim about AI-assisted hacking: untrusted image processing sat next to a login system that could reach developer tools. The combination turned a file-upload vulnerability into repository access without requiring the researchers to compromise GitHub directly.
Patch status and the remaining questions
Hacktron says OpenAI confirmed its fix on July 25 and paid the bounty on September 1. Discourse’s response followed its own disclosure process, with a patch and additional ImageMagick sandboxing. The researchers also recommend that operators update libheif and libde265, isolate image-processing workloads and disable HEIF or AVIF decoding where it is not needed.
The disclosure leaves several questions unanswered. OpenAI has not publicly identified the affected SSO configuration in the material cited by Hacktron, and the redacted pull request prevents outside readers from independently checking the repository proof. The public account also does not say how many employee or user accounts were exposed before the fix.
What is documented is the access path: an image upload, a vulnerable decoder, remote code execution on OpenAI’s forum, an SSO escalation, a connected Codex account and a pull request in OpenAI’s internal monorepo. The bounty was $6,500, and the pull request was created on July 25, 2026.