The Forum Token Reached Codex. Codex Opened OpenAI's Internal PR.

The Hacker News led 19 September with Hacktron's write-up: three researchers, Claude Opus 5, OpenAI's public help forum, then an internal pull request. US X News carried the same chain over the weekend. US X Trends were football.

This is not a rewrite of the July Hugging Face swarm. Hugging Face was eval agents. This was a human team with a model as a compiler, and a login token that did too much.

High CVE-2026-32882 Forum upload to staff Codex to an internal PR. High because the identity hop was real, not because customer data left.

The researcher page, 13 September. Not a diagram.

The Hacker News write-up that put it on the operator board, 19 September.

What Hacktron actually published.#

Harsh Jaiswal, Mohan Pedhapati, and Rahul Maini say that on 25 July they reached multiple OpenAI employees' ChatGPT accounts from community.openai.com. Those accounts could reach Codex, and Codex could reach connectors. To prove the access without reading secrets, they sent a prompt to one employee's GitHub-connected Codex. That agent opened PR 1186742 in the internal openai/openai monorepo. Then they stopped.

The first hop was the forum's image pipeline. Discourse checked most uploads with FastImage. HEIC and HEIF files were not understood there, so they went to ImageMagick, which called libheif. The Debian 12 image under Discourse still shipped libheif 1.19.7. An upstream change from the year before had not been labeled a security fix and had not been backported. Discourse later scored the upload path as remote code execution and published GHSA-vhm9-85gw-x335 / CVE-2026-32882.

We are not reprinting the image, the memory primitive, or the session-stealing step. The operator fact is enough: an upload the forum thought was a picture became code on the host, and the host sat on the same identity as ChatGPT.

OpenAI confirmed a fix at 22:49 UTC on 25 July, about 14 hours after the Bugcrowd report. On 1 September it paid $6,500 and marked the report resolved. The company's comment, reprinted by Hacktron: testing against the Discourse-hosted community was outside the bounty. The award recognizes the OpenAI-side finding, not the actions against Discourse.

Why the model is in the headline.#

Opus 4.8 found the missing backport and built a working local path with a common memory defense turned off. It stalled once that defense was on. Anthropic shipped Opus 5 on the evening of 24 July. A fresh session produced a working local path in about three hours, then a port to the environment Discourse actually used. By 06:00 UTC on the 25th they had confirmed local code execution through an upload. By mid-afternoon they had the internal PR and had stopped.

That is the part The Hacker News led with, and it is the part that should change a threat model. The bug was old. The missing CVE on the upstream commit is why Debian still shipped it. The new fact is how cheap it was to finish. Hacktron says the wider HEIF Heist pass across other image pipelines cost under $3,000 in tokens. Those wider claims are uneven. Next.js has a vendor advisory. The rest is the team's word. Do not file Slack or Meta as confirmed from this brief.

1. 2026-07-23
   Hacktron starts on Discourse's HEIC upload path. FastImage skips the format. ImageMagick calls a stale libheif.
2. 2026-07-24
   Opus 4.8 stalls with ASLR on. Opus 5 ships that evening and produces a working local path in hours.
3. 2026-07-25
   05:00 to 06:00 UTC: RCE on community.openai.com. Bugcrowd report. Afternoon: staff Codex opens PR 1186742. 22:49 UTC: OpenAI confirms its side is fixed.
4. 2026-07-28
   Discourse publishes GHSA-vhm9-85gw-x335. Rebuild the image. Hosted customers already patched.
5. 2026-09-01
   OpenAI pays $6,500. Award is the SSO finding, not Discourse testing.
6. 2026-09-13
   Hacktron publishes. The Terminal and The Hacker News follow. X News is still carrying it this weekend.

What this is not.#

It is not a customer-data incident. Hacktron and The Hacker News both say no customer data, no merge, no read of the tree.

It is not Hugging Face, the wiki, or the May RubyGems flood. Those were eval agents storing state on someone else's host. This was a login token minted for a forum.

It is also not a reason to rip Codex out of GitHub. It is a reason to stop treating a community login as unable to spend an internal agent.

What to do.#

If you run Discourse, Sign in with a lab SSO, or an agent that can open internal pull requests:

1. Rebuild self-hosted Discourse from the latest image. Discourse's own line is ./launcher rebuild app after a pull. Web-UI update is not the control. Lines that include the extra image-processing sandbox are 2026.7.0, 2026.6.1, 2026.5.2, and 2026.1.6.
2. If you do not need HEIC, HEIF, or AVIF from strangers, turn that decode off. Isolate whatever still must parse those files.
3. Scope Sign in with OpenAI, or your equivalent, so a community session cannot mint ChatGPT, Codex, or connector access. Step-up before an agent can write to an internal org.
4. Inventory which staff Codex and ChatGPT accounts are bound to GitHub, Slack, or mail. Those bindings are the blast radius of the next forum.
5. Hunt July 25 forum sessions and unexpected internal PRs from agent identities. Absence of a second headline is not a hunt.

The package clock on libheif was a silent upstream commit. The identity clock was a forum token that could open an internal PR. Patch the image. Then shrink what that token can spend.