🔒ChatGPT Accounts Hacked via Chained Vulnerabilities
Hackers Gain Full Access to OpenAI Repositories
TL;DR
Hackers exploited chained vulnerabilities to gain full access to OpenAI employees' ChatGPT accounts, compromising internal repositories and multiple services. The attack used libheif, ImageMagick, and Discourse, and was reported and fixed within days.
Hackers exploited chained vulnerabilities to gain full access to OpenAI employees' ChatGPT accounts, compromising internal repositories and multiple services. The attack, which began on July 23, 2026, used libheif, ImageMagick, and Discourse to bypass security measures. This highlights the critical importance of rapid vulnerability patching and robust security practices. The vulnerabilities were fixed by OpenAI and Discourse on July 26 and 28, 2026, respectively, with OpenAI paying a $6,500 bounty for the discovery.
Key Points
Hackers exploited chained vulnerabilities in libheif, ImageMagick, and Discourse to gain full access to ChatGPT accounts on July 25, 2026.
The vulnerabilities were discovered on July 23, 2026, and fixed by OpenAI and Discourse on July 26 and 28, 2026, respectively.
OpenAI paid a $6,500 bounty for the discovery of the vulnerabilities, highlighting the severity and complexity of the exploit.
The vulnerabilities affected multiple services, including GitHub, Slack, and emails, impacting OpenAI's internal operations.
Debian 12 and 13 were found to be vulnerable, with Debian publishing a security update for Debian 13 on August 8, 2026.
Why It Matters
If you're using any of the affected tools (libheif, ImageMagick, Discourse) in your development environment, you need to update immediately. The rapid timeline from discovery to full compromise underscores the importance of swift action. OpenAI's quick response and $6,500 bounty demonstrate the seriousness of the issue.
Comments
Be the first to comment
Enjoyed this article?
Get it daily. 7am. Free. Reads in 5 minutes.
Join 3,483 builders reading daily.