Security 1 publisher2 min readPublished September 18, 2026 at 5:59 AM PDT

Hacktron chained a Claude-written libheif exploit into OpenAI's internal repositories

The libheif bug was fixed upstream a year earlier without a security label or a CVE, so a Discourse image check that ignored HEIC left it reachable, and forum sign-in tokens carried full API access to the accounts behind them.

The Watch · Security desk

What happened

Hacktron needed several attempts with Claude Opus 4.8 and Opus 5 to build reliable remote code execution for an unpatched libheif flaw, testing it on a Discourse instance before running it on OpenAI's forum.
Discourse's built-in image checks did not support HEIC/HEIF, so uploads in that format were handed to ImageMagick, which decodes them using libheif.
Because community.openai.com accepted OpenAI account sign-in, code execution on the forum meant any user or employee who had logged in could have had their ChatGPT and Codex accounts taken over.
Hacktron took over an OpenAI employee account whose Codex integration was linked to OpenAI's GitHub organization, opened a pull request in an internal repository, and stopped testing there.
OpenAI confirmed a fix about 14 hours after the Bugcrowd report and paid a $6,500 bounty, while Discourse had a fix ready within two days and added image-processing sandboxing.

Compiled by The WatchSomething wrong?How this is made

Why it matters

constraint Catching this required tracking the libheif version in the dependency tree, because a CVE-keyed patch program had no identifier to alert on.
exposure A community forum wired to production identity puts every employee who signs in, and whatever they have connected to that account, within reach of a file upload.
capability If a few LLM attempts are enough to weaponise an obscure decoder bug, the gap between a quiet upstream fix and a working exploit narrows for anyone reading commit logs.
contradiction Hacktron and OpenAI do not agree on reach: OpenAI says the Slack access Hacktron raises was never verified, so how far the intrusion is scoped depends on which account a responder takes.

Hacktron says the libheif bug was corrected upstream a year before this work, was never flagged as a security issue, and so was never assigned a CVE ^[3]. A patch program that reads CVE feeds has nothing to match. No vulnerability feed would have told community.openai.com that its decoder was behind ^[2].

When the validator's list of supported formats is shorter than the decoder's, the formats the validator does not recognise still reach the library ^[3].

OpenAI's half of the chain was permission scope. Sign-in tokens generated for the community forum carried excessive permissions and granted full API access to the associated ChatGPT and Codex accounts, according to SecurityWeek's account of the finding ^[5].

OpenAI draws a line between the two bugs. It told SecurityWeek that the image-processing flaw lived in the third-party service Discourse, while the account-takeover path was a separate, OpenAI-side issue ^[4]. Both halves were required. Closing them took two bug bounty programs, Bugcrowd for the token permissions and HackerOne for the decoder ^[1].

On scope, OpenAI said its own review of the incident found limited reads of private-repository metadata and commits, followed by the researcher-submitted pull request, to a README file ^[8]. The report does not date the fixes.

In a statement, OpenAI said, "We thank the researchers for contacting us and sharing their findings. We narrowed the permissions on Community sign-in tokens and revoked affected tokens and sessions." ^[14]

What to watch

Whether libheif maintainers or distributions retroactively assign a CVE to the silently fixed bug, giving scanners something to match.
Whether other services that accept OpenAI-account sign-in were issued tokens with the same API permissions OpenAI says it has now narrowed.
Whether other Discourse-hosted community sites federated to corporate identity check their own HEIC upload handling after the advisory.

Claim ledger

Ranked by verification strength, evidence, and original report placement.

[1]
Researchers at security firm Hacktron used Claude to build a working exploit for a vulnerability in an image-processing library, then chained it with a flaw in OpenAI's sign-in system to take over employee ChatGPT and Codex accounts and gain access to internal code repositories.
ReportedSupportedView cited source
[15]
Turning the libheif flaw into a reliable exploit took several attempts and involved Claude Opus 4.8 and Opus 5; the exploit allowed remote code execution, which the researchers first used against a test Discourse instance and then on OpenAI's own forum.
ReportedSupportedView cited source
[2]
The entry point was community.openai.com, which runs on Discourse; Discourse's built-in image checks did not support the HEIC/HEIF format, so uploads in that format were passed to ImageMagick, exposing an unpatched flaw in the libheif library it relies on for decoding.
ReportedSupportedView cited source
[3]
Hacktron says the underlying libheif bug had been fixed upstream a year earlier without ever being flagged as a security issue, so it was never assigned a CVE and missed the usual patching cycle.
ReportedSupportedView cited source
[4]
OpenAI told SecurityWeek that the image-processing bug lived in the third-party service Discourse, while the account-takeover path was a separate, OpenAI-side issue.
ReportedSupportedView cited source
[5]
The OpenAI weakness was related to sign-in tokens generated for the community forum carrying excessive permissions and granting full API access to associated ChatGPT and Codex accounts.
ReportedSupportedView cited source
[6]
Because the forum let people sign in with their OpenAI account, code execution there opened a path to broader account access; Hacktron says that until the issue was fixed, any user or employee who logged into the forum could have had their ChatGPT and Codex accounts taken over.
ReportedSupportedView cited source
[7]
To demonstrate the access without reading internal code, Hacktron says it took over an OpenAI employee's account whose Codex integration was linked to OpenAI's GitHub organization, then used it to open a pull request in an internal repository before stopping further testing.
ReportedSupportedView cited source
[8]
OpenAI said its own review of the incident found limited reads of private-repository metadata and commits, followed by the researcher-submitted pull request, specifically to a README file.
ReportedSupportedView cited source
[11]
The security firm reported the account-takeover issue to OpenAI through Bugcrowd, and OpenAI confirmed a fix about 14 hours later.
ReportedSupportedView cited source
[12]
Hacktron separately reported the libheif flaw to Discourse through HackerOne; Discourse had a fix ready within two days, added image-processing sandboxing as an extra layer of defense, and published a security advisory.
ReportedSupportedView cited source
[13]
OpenAI paid Hacktron a $6,500 bounty for the OpenAI-side finding.
ReportedSupportedView cited source
[14]
In a statement, OpenAI said, "We thank the researchers for contacting us and sharing their findings. We narrowed the permissions on Community sign-in tokens and revoked affected tokens and sessions."
ReportedSupportedView cited source
[d1]
Closing the single attack chain required two separate disclosure programs: Bugcrowd for OpenAI's sign-in token permissions and HackerOne for the libheif exposure in Discourse.
DerivedSupported1 source— sign in to open
[d2]
Because the upstream libheif fix was never labeled a security issue and never received a CVE, a patch program that matches on CVE identifiers had no record to match, leaving downstream consumers of the older library version without an upgrade signal.
DerivedSupported1 source— sign in to open
[d3]
The exposure arises wherever an upload validator supports fewer formats than the downstream decoder: unrecognised formats are passed through to the library rather than rejected.
DerivedSupported1 source— sign in to open
[9]
Since people often connect other services to their OpenAI accounts, the theoretical exposure extended to services like GitHub, Slack and email.
ReportedContested2 sources— sign in to open View cited source
[10]
Hacktron's report raises Slack as a service that could theoretically have been reached through connected accounts; OpenAI says Hacktron did not verify actual access to employee Slack messages.
ReportedContested2 sources— sign in to open View cited source

Sources

Publishers with included, body-backed reporting in this cluster.

securityweek.com
2 articles · September 18, 2026
AI-Built Exploit and Sign-In Flaw Opened Path to Internal OpenAI Code

Ask Clarity

Have a question this piece left open? The answer comes from its reporting and claim ledger — nothing else.

Try

Clarity analysis

How the coverage leans and what the record actually supports. Read the methodology

Perspective Coverage

How much of the coverage speaks to builders, operators and investors. It measures emphasis, not whether the story is right.

Two mechanical details carry over to other codebases. Discourse's upload check did not know about HEIC, so those files went on to ImageMagick and were decoded by libheif, where a memory bug was still live. That bug had been fixed upstream a year earlier and filed as an ordinary bug, so no CVE exists and a dependency scanner keyed to identifiers sees nothing to flag. Hacktron needed several attempts with Claude Opus 4.8 and Opus 5 to get from crash to reliable remote code execution; that crash-to-RCE step is the one place in SecurityWeek's account where Claude was actually needed.

Reality

Evidence, adoption, hype gap, incentives and confidence, each read independently from the current record on the scale shown beneath it. How these are measured.

Evidence64

0100

One outlet, two named parties

The technical detail all comes from Hacktron's own write-up, relayed by SecurityWeek. OpenAI answered on the record, described what its log review found, and paid the bounty, so a second named party stands behind most of the chain. Discourse's advisory is referenced but its contents are not. Nobody outside the researcher and the target has reproduced any of it.

Adoption58

0100

Patched at both vendors, untracked downstream

Two fixes actually shipped. OpenAI confirmed narrowed token permissions about 14 hours after the Bugcrowd report, and Discourse had a patch in two days plus a sandbox around image processing and a published advisory. The libheif side is where remediation stops being observable: with no CVE ever assigned, other applications running the old build have nothing to match against, and SecurityWeek does not say how many applications are affected.

Topics and entities

Follow any of these and your For You feed starts watching them — no settings page required.

Topics

Entities

product
Researchers reached OpenAI's private repository through a forum bug and reused tokens
4 publishers
leadership
Builders put doom at 10 to 50 per cent and expect binding rules only after the disaster
1 publisher
build
Researchers used Claude to reach OpenAI's private code cache through an employee's account
3 publishers
leadership
The Atlantic's CEO says the bots are not sending the traffic his OpenAI deal was meant to secure
1 publisher

What happened

Why it matters

What to watch

Claim ledger

Sources

Let Clarity write the post for you.

Topics and entities

Topics

Entities

Related stories

Claim ledger

Let Clarity write the post for you.

Topics and entities

Topics

Entities

Perspective Coverage

Reality

Related stories

Sources