# The Forum Token Reached Codex. Codex Opened OpenAI's Internal PR.
> On 25 July, Hacktron reached OpenAI employee ChatGPT and Codex accounts from the public help forum, then used one employee's GitHub-connected Codex to open an internal pull request. The hop was a stale image decoder plus an OpenAI SSO token that did too much. OpenAI fixed its side in about 14 hours. Discourse tracked the upload path as CVE-2026-32882.
Source: https://hackerlogs.com/blog/hacktron-openai-forum-sso
Published: 2026-09-21
## Key takeaways
- The write-up landed 13 September. The Hacker News carried it 19 September. The work itself was 25 July: under 72 hours from first look to an internal PR.
- Forum compromise alone was not the blast. Sign in with OpenAI minted a token that reached ChatGPT and Codex. Hacktron says any service on that SSO would have done the same.
- Proof of access was PR 1186742 in openai/openai, opened by an employee's Codex. The team says it did not read source, merge, or touch customer data.
- OpenAI fixed the identity side in about 14 hours and paid $6,500 on 1 September. The award, OpenAI said, is not for testing Discourse.
- Self-hosted Discourse must rebuild the image. A web-interface update does not replace libheif. Hosted Discourse is already patched.
The Hacker News led 19 September with [Hacktron's write-up](https://www.hacktron.ai/blog/hacking-openai): three researchers, Claude Opus 5, OpenAI's public help forum, then an internal pull request. US X News carried the same chain over the weekend. US X Trends were football.
This is not a rewrite of the [July Hugging Face swarm](/blog/openai-hugging-face-incident). Hugging Face was eval agents. This was a human team with a model as a compiler, and a login token that did too much.
Forum upload to staff Codex to an internal PR. High because the identity hop was real, not because customer data left.
The researcher page, 13 September. Not a diagram.
The Hacker News write-up that put it on the operator board, 19 September.
## What Hacktron actually published.
Harsh Jaiswal, Mohan Pedhapati, and Rahul Maini say that on 25 July they reached multiple OpenAI employees' ChatGPT accounts from community.openai.com. Those accounts could reach Codex, and Codex could reach connectors. To prove the access without reading secrets, they sent a prompt to one employee's GitHub-connected Codex. That agent opened PR 1186742 in the internal `openai/openai` monorepo. Then they stopped.
The first hop was the forum's image pipeline. Discourse checked most uploads with FastImage. HEIC and HEIF files were not understood there, so they went to ImageMagick, which called libheif. The Debian 12 image under Discourse still shipped libheif 1.19.7. An upstream change from the year before had not been labeled a security fix and had not been backported. Discourse later scored the upload path as remote code execution and published [GHSA-vhm9-85gw-x335](https://github.com/discourse/discourse/security/advisories/GHSA-vhm9-85gw-x335) / CVE-2026-32882.
We are not reprinting the image, the memory primitive, or the session-stealing step. The operator fact is enough: an upload the forum thought was a picture became code on the host, and the host sat on the same identity as ChatGPT.
> Hacktron's own emphasis is the opposite. The escalation, they write, is not Discourse-specific. It is an OpenAI SSO issue. Sign in with OpenAI, through auth.openai.com, turned a forum session into ChatGPT and Codex API access for active members. Any other first-party or third-party app on that login would have been the same door.
OpenAI confirmed a fix at 22:49 UTC on 25 July, about 14 hours after the Bugcrowd report. On 1 September it paid $6,500 and marked the report resolved. The company's comment, reprinted by Hacktron: testing against the Discourse-hosted community was outside the bounty. The award recognizes the OpenAI-side finding, not the actions against Discourse.
## Why the model is in the headline.
Opus 4.8 found the missing backport and built a working local path with a common memory defense turned off. It stalled once that defense was on. Anthropic shipped Opus 5 on the evening of 24 July. A fresh session produced a working local path in about three hours, then a port to the environment Discourse actually used. By 06:00 UTC on the 25th they had confirmed local code execution through an upload. By mid-afternoon they had the internal PR and had stopped.
That is the part [The Hacker News](https://thehackernews.com/2026/09/claude-opus-5-helped-researchers-take.html) led with, and it is the part that should change a threat model. The bug was old. The missing CVE on the upstream commit is why Debian still shipped it. The new fact is how cheap it was to finish. Hacktron says the wider HEIF Heist pass across other image pipelines cost under $3,000 in tokens. Those wider claims are uneven. Next.js has a vendor advisory. The rest is the team's word. Do not file Slack or Meta as confirmed from this brief.
> A coding agent connected to an internal GitHub org is a privileged identity. Once the session is someone else's, the agent will open the pull request you ask for. The pin and the review do not run if the user of record is already staff.
## What this is not.
It is not a customer-data incident. Hacktron and The Hacker News both say no customer data, no merge, no read of the tree.
It is not Hugging Face, the [wiki](/blog/openai-wiki-incident-c2), or the [May RubyGems flood](/blog/openai-rubygems-gemstuffer). Those were eval agents storing state on someone else's host. This was a login token minted for a forum.
It is also not a reason to rip Codex out of GitHub. It is a reason to stop treating a community login as unable to spend an internal agent.
## What to do.
If you run Discourse, Sign in with a lab SSO, or an agent that can open internal pull requests:
1. Rebuild self-hosted Discourse from the latest image. Discourse's own line is `./launcher rebuild app` after a pull. Web-UI update is not the control. Lines that include the extra image-processing sandbox are 2026.7.0, 2026.6.1, 2026.5.2, and 2026.1.6.
2. If you do not need HEIC, HEIF, or AVIF from strangers, turn that decode off. Isolate whatever still must parse those files.
3. Scope Sign in with OpenAI, or your equivalent, so a community session cannot mint ChatGPT, Codex, or connector access. Step-up before an agent can write to an internal org.
4. Inventory which staff Codex and ChatGPT accounts are bound to GitHub, Slack, or mail. Those bindings are the blast radius of the next forum.
5. Hunt July 25 forum sessions and unexpected internal PRs from agent identities. Absence of a second headline is not a hunt.
The package clock on libheif was a silent upstream commit. The identity clock was a forum token that could open an internal PR. Patch the image. Then shrink what that token can spend.
## Sources
- [Hacking OpenAI](https://www.hacktron.ai/blog/hacking-openai) (2026-09-13)
- [Claude Opus 5 Helped Researchers Take Over OpenAI Staff Accounts via Chained Flaws](https://thehackernews.com/2026/09/claude-opus-5-helped-researchers-take.html) (2026-09-19)
- [RCE via malformed HEIF file](https://github.com/discourse/discourse/security/advisories/GHSA-vhm9-85gw-x335) (2026-07-28)
- [How researchers reached OpenAI's internal repo via SSO bug](https://theterminal.space/ai/hacktron-openai-heap-overflow-sso-chain) (2026-09-18)