An Agent Connection Crossed the Boundary
Hacktron (13 September 2026) traced a crafted HEIC upload through Discourse’s unsupported-format fallback and ImageMagick’s outdated photo decoder. An overwrite let instructions run on the forum server. An overprivileged OpenAI community token enabled control of staff accounts in ChatGPT/Codex. A GitHub connection permitted an innocuous change proposal in a confidential repository. Researchers stopped, reporting no code downloads.
The report (18 September 2026, 08:45 ET) relays the company’s review: limited reading of repository descriptors and commit data before a README proposal; Slack-message access was unverified. It cut token privileges, cancelling affected sessions and tokens.
The $6,500 award covered only the separate identity bug; forum testing was excluded. Bugcrowd reporting preceded fix confirmation by about 14 hours. An agent’s integrations inherit their connected privileges.
Response
- Separate public-community identity from employee services and broad APIs.
- Inventory agents’ private-repository, cloud and build connections.
- Restrict delegation by repository, time and task.
- Rebuild self-hosted installations; interface updates can miss containers. The hosted service was already repaired. Check libheif advisories and backports; researchers identified 1.23.4 as its latest secured release on 14 September 2026. Update libde265 too; disable unnecessary HEIF/AVIF handling or confine it to disposable, hardened sandboxes.
- Treat demonstration changes as evidence of writing capability, never theft.
