Redbot Labs / Threat Intelligence
AI-Assisted Research Chains OpenAI Forum Exploit into ChatGPT and Codex Account Takeover
- Incident ID
- RBT-TI-0090
- Organization
- OpenAI
- Reported Location
- San Francisco, California, United States
- Severity
- Critical
- Category
- AI-Assisted Exploitation / Account Takeover / Connected Tool Abuse
- Record Date
- 2026-09-13
Incident Summary
Hacktron researchers reported chaining an image-processing vulnerability with an OpenAI single sign-on flaw to take over employee ChatGPT and Codex accounts.
Using a connected Codex account, they demonstrated impact by creating a harmless pull request in an internal repository. They state that they avoided reading internal code and stopped testing. Hacktron research
What Happened
AI-assisted exploit development
Researchers used Claude models to help develop an exploit targeting the forum’s image-processing dependency.
Cross-service account access
The forum compromise combined with an identity flaw enabled access to employee AI accounts and a connected repository workflow.
Disclosure and remediation
Hacktron reports that OpenAI confirmed its fix on July 25. The researchers disclosed their findings publicly in September. Research timeline
Vendor-confirmed image-processing vulnerability
Discourse’s advisory identifies CVE-2026-32882 as a libheif vulnerability permitting remote code execution through image uploads. Its remediation includes a patched Docker image and additional image-processing sandboxing. Discourse advisory
Affected Systems
OpenAI Community Forum / Employee ChatGPT and Codex Accounts / Connected GitHub Repository Workflow
Attack Vector
Indirect Prompt Injection / Zero-Click Data Exfiltration
Business Impact
Demonstrated repository action
The proof of concept demonstrated an internal repository action through a compromised employee account.
Evidence limits
This report documents researcher activity, not confirmed criminal exploitation or source-code theft. OpenAI’s bounty covered the OpenAI-side finding; the forum was outside its bounty scope. Hacktron disclosure
Redbot Analysis
Validate the complete path to sensitive actions
Redbot Labs assesses that AI security testing should include the applications, identities, and integrations surrounding an assistant. A model can operate as designed while an attacker abuses the account or permissions through which it receives instructions.
Testing should establish whether compromise of a public-facing service can cross into employee sessions, connected tools, or privileged workflows.
Treat integrations as delegated authority
Connecting an assistant to a repository gives the assistant a defined set of capabilities. Those capabilities become part of the account’s potential exposure.
Organizations should inventory connected services, restrict repository access, separate read and write permissions, and require independent approval for consequential changes. Connector permissions should reflect the smallest scope needed for the task.
Test identity isolation between services
A shared login experience should not allow a lower-trust application to assume authority over unrelated services. Assessments should examine session boundaries, token audiences, account linking, and the consequences of a compromised relying application.
The practical question is how far a compromised service can act using an employee’s identity.
Include dependencies in operational validation
Application updates alone may not replace vulnerable components inside a container image. Security validation should inspect deployed artifacts and confirm that fixes reached the running environment.
Image processing and other parsers handling untrusted files should operate with restricted permissions and limited access to sensitive services.
Measure outcomes across the stack
Redbot’s assessment approach should connect individual findings to demonstrable business actions: account access, document retrieval, repository changes, or other privileged operations. This makes remediation priorities reflect the consequences of combined weaknesses.
Sources
Discourse Security Advisory - Remote Code Execution via Malformed HEIF File
