Claude helped exploit a Discourse flaw affecting OpenAI, researchers report

• A three-person research team reported chaining a HEIF image-upload path into remote code execution on OpenAI's Discourse forum, then an SSO flaw into employee ChatGPT and Codex access, with an internal-monorepo pull request as its proof of impact, according to Yuchenj_UW's exploit-chain report.
• The researchers said Claude Opus 4.8 repeatedly failed to produce a working ASLR-enabled exploit, while Opus 5 succeeded within hours and GPT-5.6 Sol made a later blind-target stage easier, as haider1's research screenshot recounts.
• OpenAI awarded $6,500 for the OpenAI-side finding, while its review found only limited reads of private-repository metadata and code changes, with no model weights believed exposed, per cedric_chee's bounty screenshot and rohanpaul_ai's WSJ summary.
• The vulnerable decoder sat upstream in libheif, not in a single app: cramforce's disclosure says the same path reached Next.js image optimization and other image-processing stacks.

The researchers' published account says they used a compromised employee's Codex to open PR #1186742 without reading sensitive material. Vercel's technical account maps the Next.js route from next/image down through sharp and libvips to libheif, four layers below the application surface. The memorable part is an ordinary attack chain whose execution threshold got smaller.

The researchers' reported chain had five steps:

1. Upload a HEIC or HEIF image to OpenAI's community forum.
2. Send the image through ImageMagick and libheif decoding.
3. Trigger a libheif heap overflow and obtain remote code execution on the Discourse host.
4. Chain that foothold with an OpenAI SSO flaw to take over ChatGPT and Codex sessions.
5. Use the account's connected GitHub access and Codex to open a pull request in the internal openai/openai monorepo.

Their timeline began with researchers finding the image-processing flaw on July 23, before asking Claude Opus 4.8 to generate an exploit, according to kimmonismus's WSJ screenshots. The team said it used the resulting Codex access to create the pull request rather than inspect private content; rohanpaul_ai's WSJ summary relayed OpenAI's statement that its review found limited reads of repository metadata and code changes.

The model comparison in the disclosure is unusually specific. Opus 4.8 struggled across several sessions with ASLR enabled, the researchers said, then Opus 5 produced a local ARM64 exploit within three hours and was later ported to Discourse's x86-64 and jemalloc environment.

Their published log, shown in nrehiew_'s post, says the researchers ran Claude in an autonomous /goal loop against their own proxied Discourse Cloud instance after the model refused to write an exploit for a remote target. The same log says it achieved RCE on that test instance within roughly four hours, then the team used the generated script against OpenAI's instance.

One post identified the three researchers as Rahul Maini, Mohan Pedhapati, and Harsh Jaiswal deedydas's post. The under-$3,000 figure covers the wider two-month HEIF Heist campaign, including work against other targets, not only the OpenAI exercise, according to haider1's research screenshot.

OpenAI's $6,500 award came with a narrow scope statement. Its posted clarification said testing the Discourse-hosted community.openai.com was explicitly outside the bug-bounty program, and that the award recognized the OpenAI-side finding rather than actions against Discourse.

That distinction separates the initial server compromise from the identity and connected-service escalation that made the finding consequential. The public account claimed access could reach Outlook, Slack, GitHub, and other connectors, while OpenAI's reported review limited the disclosed observed impact to repository metadata and code changes rohanpaul_ai's WSJ summary.

The incident concerned a networked forum, SSO, and connected developer tools. A related debate drifted toward whether isolated agents could communicate through side channels.

In that clarification, polynoamial said the thought experiment involved coordination between two supposedly isolated agents, not temperature-sensor weight exfiltration, and described airgapping as an extremely strong safeguard. The stated lesson from a separate Hugging Face incident was that sandbox isolation needed independent safeguards around it polynoamial's clarification.

Vercel traced its own exposure to next/image calling /_next/image, then sharp, libvips, and finally libheif. Its mitigation timeline says Hacktron reported the issue on August 11-12; Vercel disabled AVIF optimization and resizing in its central Image Optimization Service on August 13.

• On August 25, libheif released v1.23.2 with the RCE remediated.
• The same day, Next.js shipped a security release that disabled AVIF optimization and resizing for self-hosted users while patched libheif propagated downstream.
• Vercel said its centralized image service sandboxed hostile payload handling, but it kept AVIF handling disabled.

The public oss-security notice records the wider libheif and libde265 vulnerability disclosure. As of a later reply, cramforce's update said the affected functionality remained deactivated out of caution.