# How OpenAI got hacked with an image Source: https://www.youtube.com/watch?v=gjHh9g7yo9Y Recap page: https://rapidrecap.app/video/gjHh9g7yo9Y Generated: 2026-09-18T03:52:05.935+00:00 --- ## The Gist Security researchers exploited a one-year-old patched vulnerability in libheif through ImageMagick and Discourse to achieve remote code execution on OpenAI developer forums and gain unauthorized access to internal repositories. ## Quick Overview Security researchers Harsh Jaiswal and Rahul Mohan compromised OpenAI internal infrastructure by chaining a series of vulnerabilities involving image processing libraries and forum software. By uploading a crafted HEIF image to the Discourse community platform, they triggered a heap buffer overflow in libheif that had been patched a year earlier but remained unpatched in the specific Debian Docker container used by Discourse. This exploit successfully executed remote code on community.openai.com, allowing the researchers to escalate their access and create pull requests inside OpenAI internal GitHub repositories. **Key Points:** - Security researchers Harsh Jaiswal and Rahul Mohan discovered a chain of vulnerabilities allowing remote code execution on the OpenAI developer forum. - The attack began by targeting libheif, a library used for handling High Efficiency Image File Format images. - A commit made on May 5, 2025, titled simplify overlay overlap area computation, fixed a heap buffer overflow vulnerability in libheif. - The vulnerable version of libheif, version 1.19.7, was bundled in the Debian 12 bookworm Docker image used by Discourse instances at the time. - When a user uploaded a crafted HEIF image to the Discourse forum, ImageMagick passed the file directly to libheif for conversion, triggering a heap buffer overflow. - The exploit successfully achieved remote code execution under the www-data user ID inside the Discourse container environment. - By leveraging this forum access, the researchers successfully opened a pull request inside OpenAI internal GitHub repositories to demonstrate the severity of the flaw. - OpenAI awarded the researchers $6,500 through their bug bounty program for the vulnerability chain. ![Screenshot at 09:12: The successful remote code execution output displaying the www-data user ID inside the Discourse environment.](https://ss.rapidrecap.app/screens/gjHh9g7yo9Y/00-09-12.jpg) **Context:** OpenAI uses various third-party and open-source applications to run developer communities and internal tools. Security researchers frequently test these platforms for zero-day and n-day vulnerabilities to evaluate the security postures of major artificial intelligence companies. ## Detailed Analysis The exploit relies on a multi-step vulnerability chain that begins with image parsing in libheif and ends with repository access on OpenAI infrastructure. When handling user-uploaded image files, Discourse attempts to optimize and convert formats using ImageMagick and underlying format-specific libraries. The researchers identified that HEIF files received special handling that bypassed certain standard checks and passed directly to libheif. A heap buffer overflow existed in the overlay overlap area computation of older libheif versions due to a faulty integer cast where negative offsets were treated as massive positive values. Although the bug was fixed in upstream repositories a year prior, software distributions like Debian 12 still shipped vulnerable versions in their package managers. By uploading a specially crafted HEIF file to the Discourse forum profile background uploader, the application processed the file and triggered the memory corruption bug, granting remote code execution. The researchers then used this forum administrator access to locate internal OpenAI workflows, create a branch in an internal GitHub repository, and submit a pull request modifying the README file to prove unauthorized access. ### Vulnerability Research in Image Processing The attack originated from analyzing security flaws in image conversion dependencies used by web platforms. - ImageMagick acts as a suite for editing images by delegating specific file formats to specialized underlying libraries like Ghostscript and libheif. - Security researcher Harsh Jaiswal previously investigated vulnerabilities in image processing libraries to find parsing flaws. - Default configurations in platforms like Discourse disable external delegates for security reasons, making specific file format parsers critical attack surfaces. ![Screenshot at 01:54: Code highlighting the delegate configuration and dependencies within ImageMagick.](https://ss.rapidrecap.app/screens/gjHh9g7yo9Y/00-01-54.jpg) ### Discovering the Flaw in Libheif The specific vulnerability resided in how libheif handled overlay calculations for HEIF images. - Discourse processes HEIF image uploads by passing them directly to libheif for conversion into standard JPEGs. - A suspicious commit from May 2025 titled simplify overlay overlap area computation fixed a heap buffer overflow caused by incorrect sign casting. - The vulnerable package version 1.19.7 was installed in the Debian 12 Docker container used by the target Discourse installation. ![Screenshot at 06:09: The git commit showing the vulnerable overlay overlap code where negative coordinate checks were bypassed.](https://ss.rapidrecap.app/screens/gjHh9g7yo9Y/00-06-09.jpg) ### Executing Remote Code on Discourse The researchers deployed the exploit payload against a local instance of Discourse to verify the attack vector. - Uploading the crafted HEIF exploit file through the user profile avatar settings triggered the vulnerable libheif decoding path. - The buffer overflow resulted in remote code execution running under the www-data user context on the server. - Successful execution allowed the creation of arbitrary files within the public assets folder of the web application. ![Screenshot at 09:05: Dragging the exploit HEIF file into the Discourse post editor to trigger the payload.](https://ss.rapidrecap.app/screens/gjHh9g7yo9Y/00-09-05.jpg) ### Hacking OpenAI Internal Repositories Having gained remote code execution on the community forum, the attackers escalated their reach toward OpenAI infrastructure. - The researchers targeted community.openai.com, which ran the vulnerable Discourse platform configuration. - After gaining administrator access to the OpenAI community forum, they examined integrated workspace connectors and authentication flows. - The exploit successfully created a new branch and submitted a pull request inside OpenAI internal GitHub repositories to verify the breach. ![Screenshot at 11:22: The GitHub diff view displaying the modified README file committed by the exploit on OpenAI infrastructure.](https://ss.rapidrecap.app/screens/gjHh9g7yo9Y/00-11-22.jpg) ### Disclosure and Bug Bounty Outcome The findings were reported directly to OpenAI security teams, leading to a financial reward. - The researchers immediately reported the Discourse remote code execution vulnerability to OpenAI security personnel. - OpenAI verified the findings and awarded the researchers $6,500 for the escalation vector from the forum to internal repositories. - The incident highlighted the risks of relying on outdated package versions within containerized web server environments. ![Screenshot at 12:47: The bug bounty reward notification confirming the payout of $6,500.](https://ss.rapidrecap.app/screens/gjHh9g7yo9Y/00-12-47.jpg)