Security researchers at Hacktron AI discovered a memory-corruption bug in an image library used by OpenAI's forum, then used Anthropic's Claude Opus 5 to develop a working exploit that achieved remote code execution and access to OpenAI's private repositories within 72 hours. The vulnerability stemmed from an unpatched libheif flaw in Discourse combined with excessive permissions in OpenAI's single sign-on system.
HEIF Heist is a class of remote attack exploiting vulnerabilities in native C/C++ image decoders like libheif and libde265 to achieve memory corruption, data exfiltration, or remote code execution. The vulnerability affects applications processing untrusted HEIF, HEIC, or AVIF images across web frameworks, cloud services, and communication platforms. Mitigation requires updating to patched versions and implementing defense-in-depth strategies like sandboxing image processing.
On July 25, 2026, security researchers chained a heap buffer overflow in libheif with an OpenAI SSO misconfiguration to compromise employee ChatGPT accounts and access internal OpenAI repositories. The attack exploited image upload functionality on OpenAI's community forum and was reported responsibly, resulting in a $6,500 bounty.
Hacktron disclosed a chain of two critical vulnerabilities discovered on July 25, 2026 that could compromise OpenAI employees' ChatGPT accounts: a heap buffer overflow in libheif and an SSO misconfiguration on community.openai.com. The researchers demonstrated access by opening a pull request in OpenAI's internal repository and received a $6,500 bounty after coordinated disclosure.
HEIF Heist is a class of remote vulnerabilities in HEIF, HEIC, and AVIF image decoders (libheif, libde265) that affect services including OpenAI, Slack, Meta, and GitHub. By uploading crafted images, attackers can trigger memory corruption, data exposure, or remote code execution below the application layer. The Hacktron research team discovered the vulnerability affects numerous platforms and recommends updating to patched versions and implementing defense-in-depth strategies.
Security researchers chained two critical vulnerabilities to compromise OpenAI employee accounts on July 25, 2026, gaining access to internal repositories within 72 hours. The vulnerabilities involved an SSO misconfiguration and a libheif RCE in OpenAI's community forum. OpenAI and Discourse were notified and patched the issues; OpenAI awarded a $6,500 bounty.