Cases › security breach › LR-2026-0725
Malicious HEIF upload reached OpenAI internal GitHub
Preliminary Why: 1 report: eSecurity Planet · subject to change · 1 independent report
Status: fix reported
No source states: loss or records, developer and model, agent tool, could do, deployer, industry.
A malicious HEIF image uploaded to OpenAI's public community forum gave researchers a path to the company's internal GitHub environment. The forum's image handling passed HEIC and HEIF files to ImageMagick, which exposed a libheif parser with an unpatched heap-buffer-overflow flaw. Researchers chained this with a separate single sign-on flaw and gained access to employee ChatGPT and Codex accounts. They used a GitHub-connected Codex instance to create a harmless pull request in OpenAI's private monorepo as proof of access, then stopped testing. The researchers reported the identity issue in July, and OpenAI fixed it roughly 14 hours later. Researchers published the full chain on September 13. On September 15, Discourse updated its default base image and confirmed that image processing is now sandboxed.
What happened
What was done
“On September 15, Discourse updated its default base image to include libheif 1.23.4 and confirmed that image processing is now sandboxed.”
Risks
Read from the sources; not yet reviewed by a person.
Controls
ModelEffective Flaw reporting and bug bounty
Control failure chain
L1 · ModelProvider not namedModel provider
Model version not linked to a model card.
L2 · HarnessHarness not namedAgent framework vendor
No source mentions a control at this layer.
L3 · ApplicationDeployer not namedDeployer
No source mentions a control at this layer.
Other controls for this risk at this layer, not mentioned in the sources: Short-lived, scoped credentials, Secrets kept out of the model's context, Separate identity for each agent, Least-privilege access for the agent, Alerts on unusual tool use, Activity logs, Sensitive-data checks on outbound data.
L4 · Infrastructure / targetOrganisation hit
No source mentions a control at this layer.
Other controls for this risk at this layer, not mentioned in the sources: Multi-factor sign-in and password policy, Secrets scanning.
EffectiveNot effectiveNot effective (bypassed)Did not existNot stated in sourcesNot yet checkedAttacker's ownOrder: model · harness · application · target
Controls for this risk: result in this incident
| Control | Part of the system | Result |
|---|---|---|
| Flaw reporting and bug bounty | L1 Model | Effective |
| Least-privilege access for the agent | L3 Application | Not stated in sources |
| Separate identity for each agent | L3 Application | Not stated in sources |
| Short-lived, scoped credentials | L3 Application | Not stated in sources |
| Secrets kept out of the model's context | L3 Application | Not stated in sources |
| Activity logs | L3 Application | Not stated in sources |
| Alerts on unusual tool use | L3 Application | Not stated in sources |
| Sensitive-data checks on outbound data | L3 Application | Not stated in sources |
| Multi-factor sign-in and password policy | L4 Infrastructure / target | Not stated in sources |
| Secrets scanning | L4 Infrastructure / target | Not stated in sources |
Evidence
- What was done OpenAI fixed the identity-side issue roughly 14 hours after it was reported in July
No source states: what went wrong, what it reached or did, when it happened, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off, what was done.
Show the full account: 6 items from the primary sources
What happened, in order
- July Identity-side issue reported in July and fixed by OpenAI roughly 14 hours later.
- July 25 Compromise of OpenAI's Discourse-hosted forum on July 25.
- By July 25 Remote code execution on the forum achieved, and an employee account with a connected Codex instance taken over.
- September 13 Hacktron published the full attack chain.
- September 15 Discourse updated its default base image to libheif 1.23.4 and confirmed sandboxed image processing.
Not dated in the sources:
- Researchers instructed Codex to open pull request #1186742 as proof of access, then stopped testing.
Show every field, with its source and grade
What happened
Impact
Notes on gaps
The article's sandboxing and hardening recommendations are advice and were not recorded as controls that held in this incident.
LR-2026-0725 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON