On July 25, 2026, the Hacktron security research team chained two critical vulnerabilities to gain access to the ChatGPT and Codex accounts of several OpenAI employees. From there, they were able to access OpenAI’s internal repositories and connected services such as GitHub, Slack, and email. The entire process from discovery to takeover took less than 72 hours.
Exploit chain from HEIC images to internal repos
The exploit began with a little-noticed image processing library. Libheif—an open-source library used to decode HEIC/HEIF/AVIF images—contained a heap buffer overflow vulnerability. This vulnerability had been fixed upstream but was not recorded as a security patch, so neither Debian 12 nor 13 backported it.
Discourse, the forum platform OpenAI uses for community.openai.com, is based on Debian 12 and had libheif version 1.19.7 installed, which remained vulnerable. When users uploaded HEIC images, Discourse passed them to ImageMagick for processing, directly exposing the libheif parser to attacker-controlled data.
However, the libheif vulnerability was only the first step. The second step was key: OpenAI allows users to log into the forum using an OpenAI account (SSO). After taking control of the forum, the research team exploited a flaw in the SSO authentication flow to hijack the ChatGPT and Codex accounts of logged-in employees.
Claude’s role in the exploitation process
The Hacktron team used Claude Opus 4.8 to analyze the libheif vulnerability and develop the initial exploit. They ran an Opus 4.8 session with Discourse’s Docker image, asking it to audit security issues in the libheif package. Claude identified several security patches that had not been backported.
On the evening of July 24, the exact day Anthropic released Claude Opus 5, the team switched to the new model. Within 3 hours, Opus 5 generated a working ARM64 exploit on a local Mac. Next, the team placed Claude into an autonomous loop against their own Discourse instance. By 10:00 AM the next morning, the agent had achieved remote code execution.
Notably, Opus 5 refused to write an exploit targeting a remote instance. The team had to proxy through a domain disguised as a CTF challenge to trick the model. This demonstrates both the powerful capabilities and the safety boundaries of the model.
OpenAI and Discourse response
OpenAI responded within 14 hours of receiving the report, confirming the issue had been fixed and awarding a $6,500 bounty through its Bug Bounty program. Discourse reacted even faster: receiving the report on Saturday, responding on Sunday, releasing a patch on Monday, and initiating sandboxing for ImageMagick.
However, OpenAI noted that testing against community.openai.com fell outside the scope of its bounty program. The $6,500 bounty was awarded solely for discoveries on the OpenAI side, not actions taken against Discourse.
Lessons in security supply chains
This incident exposes a systemic issue: small open-source libraries (like libheif) are used by thousands of projects but undergo little security auditing. Attackers do not need to target the primary application; they only need to find vulnerabilities in the dependencies it uses.
For OpenAI, the lesson cuts even deeper. A leading AI company, with billions of dollars invested in model safety, exposed an SSO vulnerability allowing employee account takeovers from a support forum. If any service utilizing OpenAI SSO were compromised, the consequences would be identical—Discourse was merely the proof of concept.
The Hacktron team stated they have expanded their research into a project called “HEIF Heist”, tracking libheif across Slack, Meta, GitHub Enterprise, Ruby on Rails, and several Node.js frameworks. If your application processes user-controlled images and accepts HEIC/HEIF/AVIF files, it is very likely affected.