Intel / post

Researchers chain a HEIF image bug into a full OpenAI account takeover

Source: x.com
Date: Published Sep 18, 2026

Thread · 3 parts

On July 25, our team hacked OpenAI. It took us less than 72 hours. Two vulnerabilities chained together gave us access to ChatGPT and Codex accounts belonging to OpenAI employees. We demonstrated the impact with a harmless PR in OpenAI’s internal monorepo. The full chain: HEIF upload → libheif heap overflow → RCE → OpenAI SSO flaw → ChatGPT/Codex takeover → connected GitHub → internal PR. OpenAI fixed the SSO issue roughly 14 hours after our report. Research by @rootxharsh, @S1r1u5_ and @iamnoooob. Full technical write-up: https://t.co/J5inrGRyXw

Sep 18, 2026

AI is changing the economics of exploitation. Capabilities that once required significantly more time, expertise and resources are becoming accessible to much smaller teams. The only solution is to keep AI safety and cybersecurity in the same conversation. More coverage by @WSJ: https://t.co/tXXKUiUEoh

Sep 18, 2026

https://t.co/RUCBLezuS8

Sep 18, 2026 View on X

Context

Researchers at Hacktron AI, working under the handles rootxharsh, S1r1u5_, and iamnoooob, say they compromised parts of OpenAI's internal systems in under 72 hours starting July 25. Their reported chain: uploading a malformed HEIF image triggered a heap overflow in libheif, the underlying image-decoding library, giving them remote code execution; they then combined that with a separate flaw in OpenAI's single sign-on to take over ChatGPT and Codex accounts belonging to OpenAI employees. Because one compromised employee's Codex account was connected to GitHub, the researchers had it open a proof-of-concept pull request inside OpenAI's internal monorepo before stopping and reporting the issue. OpenAI fixed the SSO flaw about 14 hours after the report, according to Hacktron, which published a fuller technical write-up covering the chain in more depth than the thread itself.

This disclosure was one piece of a larger libheif audit Hacktron calls HEIF Heist, which the company says found the same class of memory-corruption bug reachable through other platforms' image-upload paths, including a separate warning Hacktron issued about self-hosted Next.js deployments the previous month.

Read the source x.com