Researchers chained a forum bug into OpenAI account takeover - and it's already fixed

What actually happened

A security research outfit called Hacktron says it strung together two separate bugs to take over OpenAI employee ChatGPT and Codex accounts - and, from there, get a pull request merged into OpenAI’s internal code repository. That’s a genuinely alarming sentence, so it’s worth being precise about what’s proven and what’s colour.

The proven bit: according to Hacktron’s write-up, the entry point wasn’t ChatGPT itself but OpenAI’s own community help forum, community.openai.com, which runs on the popular Discourse forum software. Discourse’s image-upload pipeline uses ImageMagick, which in turn calls a library called libheif to decode images. Hacktron found that the Debian version of libheif shipped without a security patch it should have had, leaving a heap buffer overflow - a classic memory-corruption bug - reachable simply by uploading a crafted image.

Chained with a separate flaw in how OpenAI’s single sign-on (SSO) was configured on that forum, the researchers say this let them seize a logged-in user’s forum session and, because accounts were linked, their ChatGPT and Codex session too. From an authenticated Codex session, they were able to open an actual pull request (numbered #1186742) inside OpenAI’s internal “openai/openai” monorepo, using the compromised employee’s own tooling - proof of access without going further and snooping on anything sensitive.

So who is actually at risk

Nobody, right now, as far as the public record shows. Hacktron says it discovered the chain, reported it to OpenAI and Discourse, and the whole process from discovery to demonstrated repo access took under 72 hours - after which it went straight to disclosure rather than exploitation. OpenAI and Discourse coordinated a fix, and OpenAI paid Hacktron a $6,500 bug bounty. There’s no indication this was exploited by anyone with bad intent, and the vulnerable window is described as having closed roughly two months before the September 2026 write-up.

The bigger story bubbling up in the Hacker News discussion is less about this specific bug and more about how it was found. Commenters note Hacktron says it used an AI agent (Anthropic’s Claude, run in an autonomous “goal loop”) to independently rediscover working exploit code against a decoy instance before the researchers pointed it at the real target. That’s prompting the usual argument about whether AI agents that will “do almost anything if convinced it’s justified” are a net win for defenders finding bugs first, or a ticking clock for attackers doing the same at scale. It’s a debate, not a verified consequence - nobody in the thread claims this particular chain was AI-discovered from scratch without human direction throughout.

What this means for you

If you’re an OpenAI employee or use community.openai.com, the hole is shut and there’s a bounty receipt to show it was handled through proper channels. If you’re an ordinary ChatGPT user with no forum account, this never touched you. The genuinely interesting takeaway isn’t the specific overflow - unpatched Debian packages causing trouble is old news - it’s that agentic AI tools are now routinely part of how these chains get found, for better or worse. Worth watching, not worth panicking about.