Libheif image flaw chained to OpenAI account takeover

A flaw in the libheif image library, chained with a weakness in OpenAI's login system, was enough for three researchers at the security firm Hacktron to take over the ChatGPT and Codex accounts of several OpenAI employees and then reach an internal OpenAI code repository. Hacktron used Anthropic's Claude Opus 5 to help build the attack chain. Hacktron describes the work as security research rather than a real intrusion: the team reported the flaws to OpenAI, proved the access with a single harmless pull request, and then stopped. According to Hacktron, the path from the first look to that internal access took under 72 hours.

The chain did not begin inside OpenAI itself. It started with a bug in the software that runs OpenAI's public help forum and then moved through a weakness in OpenAI's own login system. The forum offers a "Sign in with OpenAI" option, the same single sign-on that staff use elsewhere. Single sign-on, usually shortened to SSO, is a setup in which one login is accepted by many different services, so people do not need a separate password for each one. Once the researchers controlled the forum server, that shared login let them take over the ChatGPT and Codex accounts of forum members who worked at OpenAI. According to Hacktron, the victims did not have to do anything for this to happen. The researchers say the underlying problem was an identity issue at OpenAI rather than a flaw in the forum software, and that any first-party or third-party service relying on the same sign-on could have handed over the same access.

Hacktron was careful about the limits of what it did. When one employee's Codex link to OpenAI's code on GitHub was opened, it triggered a single pull request in the internal repository. A pull request is a proposed change submitted for review, not an accepted one. The team says it did not read any source code, did not merge or ship anything, and did not touch customer data. The access could in theory have gone further, because staff connect other services to ChatGPT and Codex; the researchers say the same foothold could have extended to tools such as GitHub, Slack and email. That wider reach was possible but was not used. OpenAI confirmed a fix about 14 hours after the report, according to Hacktron, and on September 1 paid the team a 6,500 dollar bounty. OpenAI said the award "recognizes the OpenAI-side finding, not the actions against Discourse", the open-source software that runs the forum, and that testing the forum itself fell outside its bug bounty program. OpenAI has not publicly described the login flaw, and confirmed the finding through the fix and the payment rather than by detailing the account takeovers.

The technical way in was an image. The forum runs on Discourse, an open-source forum package, and Discourse passes uploaded HEIC and HEIF images to a tool called ImageMagick, which uses the libheif library to read them. HEIC and HEIF are compressed photo formats used by many phones and cameras. A flaw in libheif allowed a specially crafted image to corrupt the forum server's memory. There is a discrepancy in how that bug is rated. Discourse's advisory rates the result as remote code execution, which means an attacker can run their own code on the server, scores it 8.8 out of 10, and tracks it as CVE-2026-32882. In libheif's own advisory and in national vulnerability databases, the same identifier is described more narrowly as an out-of-bounds read, a bug that can crash the software or leak nearby memory rather than run code directly. That leaked memory is valuable to an attacker because it helps defeat a common protection called ASLR, which shuffles the layout of memory to make attacks harder to aim. The researchers say they combined libheif's memory bugs, with the AI's help, to turn the crash into working code execution on the forum server. Upstream, the flaw was fixed in libheif 1.22.0 in May 2026, months before the test. But the forum's server image, built on the Debian 12 Linux distribution, still shipped the old, unpatched libheif version 1.19.7 when the researchers looked in July. The fix and its CVE were already public, but Debian had not yet included them in the packaged version the forum used.

For anyone running their own Discourse server, this part applies directly. Rebuilding on the latest image is what brings in the patched libheif, because an update through the web interface alone may not replace the old library underneath. Sites hosted by Discourse were already patched, and the fixed self-hosted releases are 2026.7.0, 2026.6.1, 2026.5.2 and 2026.1.6.

The researchers used AI to do the hardest part of the work. They first tried Claude Opus 4.8, which struggled over several sessions to build a working exploit once ASLR, the standard memory defence, was switched on. Anthropic released its next model, Claude Opus 5, on the evening of July 24, and in a fresh session it produced a working exploit within hours. Opus 5 shipped with safeguards meant to stop it writing exploit code for real targets. The researchers got around those safeguards by pointing the model at their own test server, disguised as a capture-the-flag practice target, and then letting it run in an automated loop. Even so, they say the work was not hands off: skilled human direction still mattered, and this was not automated hacking with nobody at the controls. The case fits what researchers and AI companies have described this year, namely that capable AI models are sharply cutting the time and the skill that serious offensive work used to take. Anthropic has reported that criminal and state-backed groups are already using its Claude models to run real intrusions, not just to answer questions.

OpenAI was one target in a wider project Hacktron calls HEIF Heist. Over about two months, the team says, it found the same class of image-decoding flaws in software used by other large companies, at a total cost of under 3,000 dollars in AI usage. It links the campaign to reported bugs in Slack, Meta's products, GitHub Enterprise and web frameworks such as Next.js. Those broader claims are backed unevenly. The Next.js flaw is confirmed in Vercel's own advisory, and libheif's maintainers confirmed a working code-execution exploit for the bug tied to Meta. The wider claim of code execution across many applications has not been independently confirmed, a limit The Hacker News noted when it first covered the Next.js flaw in August. The wider campaign used a different model, OpenAI's own GPT-5.6 Sol, for cases where the team knew nothing about the target in advance. Only one company, Shopify, appears to have noticed the activity, the researchers say, even though its image processors crashed repeatedly under thousands of test uploads. The Hacker News says it has contacted Hacktron with questions about how the forum code execution was achieved and about the scope of the account access.

The bigger lessons go beyond Discourse. If a service accepts user images and read