{"schema_version":"0.10.0","id":"LR-2026-0725","record_version":1,"title":"Malicious HEIF upload reached OpenAI internal GitHub","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":45.2,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":4.8,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"1 report: eSecurity Planet · subject to change","original_document":null,"reports_total":1,"reports_independent":1,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"1 report: eSecurity Planet · subject to change"}]},"sources_hash":"a24f818b14bceab85b1bf2a14dcd295496468e9945bf9345e1ac8ba43b4e6809"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-09-21","incident_class":"security_compromise","failure_class":null,"agent_involved":true,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"public_researcher","summary":"A malicious HEIF image uploaded to OpenAI's public community forum gave researchers a path to the company's internal GitHub environment. The forum's image handling passed HEIC and HEIF files to ImageMagick, which exposed a libheif parser with an unpatched heap-buffer-overflow flaw. Researchers chained this with a separate single sign-on flaw and gained access to employee ChatGPT and Codex accounts. They used a GitHub-connected Codex instance to create a harmless pull request in OpenAI's private monorepo as proof of access, then stopped testing. The researchers reported the identity issue in July, and OpenAI fixed it roughly 14 hours later. Researchers published the full chain on September 13. On September 15, Discourse updated its default base image and confirmed that image processing is now sandboxed.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":"Separate identity flaw used to take over an employee account whose Codex instance was connected to OpenAI's GitHub organization","responsible_party":null,"adversarial_actor":"external_attacker","input_provenance":"Malicious HEIF image uploaded to OpenAI’s public community forum","time_to_contain":null,"operations_paused":null,"remediation":"OpenAI fixed the identity-side issue roughly 14 hours after it was reported in July","precursor_events":null,"primary_risk":"RK03","secondary_risks":["RK08"],"control_chain":[{"layer":"L1","party":"provider","party_name":"OpenAI","control_id":"I5","outcome":"held","reason":null,"quote":"Hacktron’s technical disclosure says OpenAI fixed the identity-side issue roughly 14 hours after it was reported in July and later awarded the researchers a $6,500 bounty.","source_index":0,"reviewed":false}],"remediations":[{"by":null,"kind":"fix","date_reported":null,"controls_added":["J1","E1"],"quote":"On September 15, Discourse updated its default base image to include libheif 1.23.4 and confirmed that image processing is now sandboxed.","source_index":0,"reviewed":false}]},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"moderate","harm_class":[],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.esecurityplanet.com/news/news-openai-heif-github-vulnerability/","publisher":"eSecurity Planet","date":"2026-09-21","type":"press","title":"Malicious HEIF Upload Reached OpenAI’s Internal GitHub, Researchers Reveal - eSecurity Planet","archived_url":null,"attachment":"first_report","independence":"independent"}],"per_field_confidence":{"event.incident_class":"C","event.agent_involved":"C","event.failure_class_detail":"C","event.detection_method":"C","event.adversarial_actor":"C","event.input_provenance":"C","event.remediation":"C","impact.severity":"D","event.primary_risk":"D","event.secondary_risks":"D","event.control_chain":"C","event.remediations":"C","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","context.country":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"event.incident_class":[{"source_index":0,"quote":"The newly public technical details show how a flaw in a public-facing file processor can cascade through identity systems and AI-agent integrations into sensitive development infrastructure."}],"event.agent_involved":[{"source_index":0,"quote":"The group gained access to employee ChatGPT and Codex accounts and used one GitHub-connected Codex instance to create a harmless pull request in OpenAI’s private monorepo."}],"event.failure_class_detail":[{"source_index":0,"quote":"By July 25, Hacktron said it had achieved remote code execution on OpenAI’s forum and used the separate identity flaw to take over an employee account whose Codex instance was connected to OpenAI’s GitHub organization."}],"event.detection_method":[{"source_index":0,"quote":"Researchers have disclosed how a malicious HEIF image uploaded to OpenAI’s public community forum ultimately opened a path to the company’s internal GitHub environment."}],"event.adversarial_actor":[{"source_index":0,"quote":"Researchers have disclosed how a malicious HEIF image uploaded to OpenAI’s public community forum ultimately opened a path to the company’s internal GitHub environment."}],"event.input_provenance":[{"source_index":0,"quote":"Researchers have disclosed how a malicious HEIF image uploaded to OpenAI’s public community forum ultimately opened a path to the company’s internal GitHub environment."}],"event.remediation":[{"source_index":0,"quote":"Hacktron’s technical disclosure says OpenAI fixed the identity-side issue roughly 14 hours after it was reported in July and later awarded the researchers a $6,500 bounty."}],"impact.severity":[{"source_index":0,"quote":"The group gained access to employee ChatGPT and Codex accounts and used one GitHub-connected Codex instance to create a harmless pull request in OpenAI’s private monorepo."}],"event.control_chain":[{"source_index":0,"quote":"Hacktron’s technical disclosure says OpenAI fixed the identity-side issue roughly 14 hours after it was reported in July and later awarded the researchers a $6,500 bounty."}],"event.remediations":[{"source_index":0,"quote":"On September 15, Discourse updated its default base image to include libheif 1.23.4 and confirmed that image processing is now sandboxed."}],"event.summary":[{"source_index":0,"quote":"Researchers have disclosed how a malicious HEIF image uploaded to OpenAI’s public community forum ultimately opened a path to the company’s internal GitHub environment."},{"source_index":0,"quote":"The files instead reached ImageMagick, exposing the underlying libheif parser to attacker-controlled images."},{"source_index":0,"quote":"Hacktron said the package lacked an upstream security fix for a heap-buffer-overflow condition that enabled out-of-bounds read and write primitives during HEIC decoding."},{"source_index":0,"quote":"The group gained access to employee ChatGPT and Codex accounts and used one GitHub-connected Codex instance to create a harmless pull request in OpenAI’s private monorepo."},{"source_index":0,"quote":"The researchers instructed Codex to open pull request #1186742 in the private openai/openai monorepo as proof of access, then stopped testing without deliberately viewing internal source code."},{"source_index":0,"quote":"Hacktron’s technical disclosure says OpenAI fixed the identity-side issue roughly 14 hours after it was reported in July and later awarded the researchers a $6,500 bounty."},{"source_index":0,"quote":"On September 15, Discourse updated its default base image to include libheif 1.23.4 and confirmed that image processing is now sandboxed."}]},"notes_on_gaps":"Only one press article (eSecurity Planet) was provided; it relays Hacktron's technical disclosure, which was not provided. The article gives July 25 and September dates without a year, so date_occurred and date_disclosed were left out rather than inferred. No model name, version, harness, tools granted, autonomy level or deployment context is stated; Codex is named only as a product. No direct financial loss, record count or affected-party count is stated; the $6,500 bounty is a reward paid, not a loss, and was not recorded as loss. Judgements made: failure_class credential_misuse was chosen from the account takeover; root_cause infrastructure was chosen for the unpatched decoder package; adversarial_actor external_attacker and detection_method public_researcher reflect that the researchers ran the chain and disclosed it; severity moderate was chosen because employee accounts and a private repository were touched with a stated bounded scope; the J2 failed and E1 missing links and the J2 remediation mapping are inferred from the described flaws, not stated as controls by the source. Trigger, responsible_party, and reversibility are not stated and were left out. The article's sandboxing and hardening recommendations are advice and were not recorded as controls that held in this incident. The 'Also read' link about Anthropic is a different incident and was ignored. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (1 report: eSecurity Planet · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"Researchers used a Codex instance to open a harmless proof-of-access pull request, then stopped.","quote":"The researchers instructed Codex to open pull request #1186742 in the private openai/openai monorepo as proof of access, then stopped testing without deliberately viewing internal source code.","source_index":0,"grade":"C"},{"step":"caught","text":"The issue was reported to OpenAI in July and the identity-side flaw was fixed about 14 hours later.","quote":"Hacktron’s technical disclosure says OpenAI fixed the identity-side issue roughly 14 hours after it was reported in July and later awarded the researchers a $6,500 bounty.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.esecurityplanet.com/news/news-openai-heif-github-vulnerability/"]},"analysis":{"sections":{"timeline":[{"text":"Compromise of OpenAI's Discourse-hosted forum on July 25.","quote":"Hacktron published the full attack chain on September 13, detailing a July 25 compromise of OpenAI’s Discourse-hosted forum that researchers chained with a separate single sign-on flaw.","source_index":0,"when":"July 25"},{"text":"Remote code execution on the forum achieved, and an employee account with a connected Codex instance taken over.","quote":"By July 25, Hacktron said it had achieved remote code execution on OpenAI’s forum and used the separate identity flaw to take over an employee account whose Codex instance was connected to OpenAI’s GitHub organization.","source_index":0,"when":"By July 25"},{"text":"Researchers instructed Codex to open pull request #1186742 as proof of access, then stopped testing.","quote":"The researchers instructed Codex to open pull request #1186742 in the private openai/openai monorepo as proof of access, then stopped testing without deliberately viewing internal source code.","source_index":0,"when":null},{"text":"Identity-side issue reported in July and fixed by OpenAI roughly 14 hours later.","quote":"Hacktron’s technical disclosure says OpenAI fixed the identity-side issue roughly 14 hours after it was reported in July and later awarded the researchers a $6,500 bounty.","source_index":0,"when":"July"},{"text":"Hacktron published the full attack chain.","quote":"Hacktron published the full attack chain on September 13, detailing a July 25 compromise of OpenAI’s Discourse-hosted forum that researchers chained with a separate single sign-on flaw.","source_index":0,"when":"September 13"},{"text":"Discourse updated its default base image to libheif 1.23.4 and confirmed sandboxed image processing.","quote":"On September 15, Discourse updated its default base image to include libheif 1.23.4 and confirmed that image processing is now sandboxed.","source_index":0,"when":"September 15"}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.esecurityplanet.com/news/news-openai-heif-github-vulnerability/"]}}