A security researcher disclosed a heap overflow in the libheif image-processing library and an SSO misconfiguration in OpenAI's identity infrastructure that, when chained together, allowed compromise of multiple OpenAI employee accounts and access to internal repositories. The attack took less than 72 hours from initial discovery to proof of concept, and OpenAI paid a $6,500 bounty.
The attack chain began with OpenAI's Discourse forum at community.openai.com, which accepts HEIC and HEIF image uploads. Discourse normally uses FastImage for image validation, but because FastImage does not support HEIF, the forum passes those files to ImageMagick's magick command for conversion. This exposed the underlying libheif parser directly to attacker-controlled files. The Hacktron team, using Claude Opus 4.8, identified that the Discourse Docker image ran libheif version 1.19.7 on Debian 12, which contained an unpatched heap buffer overflow in the HEIC decoder. The vulnerable code had been fixed upstream the previous year but was not documented as a security fix and received no CVE, which delayed backporting to Debian distributions.
The researchers used Claude Opus 4.8 to develop a working ImageMagick/libheif code-execution exploit with ASLR disabled on July 24. When Anthropic released Claude Opus 5.5 that evening, a new session produced a working ARM64 exploit within three hours and ported it to the x86-64 jemalloc configuration used by Discourse. By 6:00 a.m. on July 25, the team confirmed remote code execution through an image upload on OpenAI's Discourse instance. From there, the SSO misconfiguration became the escalation vector: the forum's "Sign in with OpenAI" feature through auth.openai.com allowed the researchers to take over an OpenAI employee's ChatGPT and Codex accounts. Because that employee's Codex was connected to OpenAI's GitHub organization, the researchers demonstrated access by having the compromised Codex open a pull request in OpenAI's internal monorepo, then stopped testing.
The entire timeline from initial discovery to repository access took less than 72 hours. OpenAI confirmed the fix roughly 14 hours after the Bugcrowd submission on July 25. The researchers emphasized that the vulnerability was not Discourse-specific: any first-party or third-party OpenAI service using the OpenAI SSO would have created the same escalation path. The libheif vulnerability itself affects a much broader ecosystem. The Hacktron team's broader "HEIF Heist" research traced the same libheif vulnerability across Slack, Meta, GitHub Enterprise, Ruby on Rails, and Node.js frameworks including Next.js, Astro, and Gatsby. The two-month campaign cost less than $3,000 in tokens and was conducted by three researchers. Adapting the exploit to each new target usually took one or two days.
The operational reality is that memory-corruption vulnerabilities, once expensive to operationalize, are now compressible into days of work with AI assistance. Claude Opus 4.8 struggled to produce a working exploit with ASLR enabled across several sessions; Claude Opus 5.5 succeeded within hours on the same problem. Across the broader HEIF Heist campaign, the researchers observed a clear jump in capability from Opus 5 to GPT-5.6 Sol. The models helped not only with exploit development but with privilege escalation, lateral movement, and defense bypass when code execution landed in sandboxed environments. According to the researchers' statement, they were "not aware of any company that detected the activity except Shopify, even after thousands of images were sent and their image processors repeatedly crashed."
The hard part is that this attack surface now exists at scale. Libheif is embedded in widely-used software across multiple release families (1.19.x, 1.20.x, 1.22.x, 1.23.x), and any deployment lacking the latest upstream security patches is potentially vulnerable. Discourse has added ImageMagick sandboxing as defense in depth, and Debian published security updates, but the underlying problem is architectural: production systems that process user-controlled images and accept HEIC, HEIF, or AVIF formats are likely affected. The researchers recommend disabling untrusted HEIF and AVIF decoding where not needed, or isolating image-processing pipelines inside hardened, ephemeral sandboxes.
For teams integrating OpenAI APIs or designing similar deployment patterns, the takeaway is that SSO misconfiguration in identity infrastructure can turn a single compromised service into access across all connected integrations—and that single service is now easier to compromise than it was a year ago.