A heap overflow and SSO misconfiguration to compromise OpenAI internal repos

Using a coding assistant to open a pull request in an internal repository is now a demonstrated attack vector.

On July 25, 2026, researchers from Hacktron AI exploited two critical vulnerabilities to gain access to internal OpenAI repositories. The first vulnerability was a heap buffer overflow in the libheif image decoding library, present in the version used by the Discourse forum software that OpenAI utilizes for its community site. The second was an SSO misconfiguration within OpenAI's identity infrastructure. By chaining these two flaws, the researchers could compromise ChatGPT and Codex accounts of OpenAI employees who logged into the community forum. This access allowed them to create a proof-of-concept pull request in OpenAI's internal monorepo, demonstrating they could access sensitive internal code without actually exfiltrating any data. The entire process, from initial discovery to accessing the repositories, took less than 72 hours. OpenAI and Discourse were notified, and patches were coordinated, with OpenAI paying a $6,500 bounty for the OpenAI-specific vulnerability. Discourse issued a security advisory for the libheif vulnerability.

The discovery highlights a significant dependency risk across the tech industry, as libheif, a core component for processing HEIF and HEIC image formats, is integrated into numerous widely-used software frameworks including Ruby on Rails, Node.js (Next.js, Astro, Gatsby), and enterprise products from Meta and GitHub. This broad adoption means that the heap overflow vulnerability, which was not clearly documented as a security fix upstream, could affect a vast number of applications processing user-controlled images. The researchers' ability to leverage an advanced AI model like Claude Opus 5 to rapidly develop and adapt exploits for different environments underscores the accelerating pace at which AI can be weaponized for offensive security purposes.

This incident demonstrates a critical interplay between third-party dependencies, identity management, and AI-powered development tools. The vulnerability in libheif, coupled with an SSO misconfiguration, created a potent attack chain, indicating that organizations must rigorously vet their supply chains and secure their single sign-on configurations to prevent lateral movement. Furthermore, the use of an AI model to expedite exploit development suggests that security teams will need to anticipate and defend against AI-assisted attacks, potentially requiring new defensive strategies and tools to counter the speed and sophistication of future threats.