Security researchers exploit heap overflow in libheif image decoder and SSO flaw to breach OpenAI employee ChatGPT accounts, access internal repositories via Discourse forum in under 72 hours; OpenAI pays $6,500 bounty after July 2026 discovery.

Hacking OpenAI

BlogHacking OpenAIA heap overflow and SSO misconfiguration to compromise OpenAI internal repositoriesSeptember 13, 202611 min readIntro On July 25, 2026, we chained two critical vulnerabilities to compromise multiple OpenAI employees’ ChatGPT accounts. With these accounts, we could then access internal OpenAI repositories, and potentially many other connectors. To prove we had in fact gained the access we believed without allowing ourselves to learn any sensitive information, we used the employe...