- Hacktron says it chained an image-library bug and a single sign-on weakness to reach OpenAI employee accounts in under 72 hours, using Claude models.
- Its argument: attack skill was a quiet shield for ordinary companies, and AI turns that skill into cheap compute. These are the firm's own findings.
- Check where your systems parse uploaded images, how patches without CVEs reach you, and how far one compromised login reaches.
Difficulty was the protection
Most companies lean on a quiet assumption. Even when a flaw is public, turning it into a working attack takes rare skill, time and knowledge of the target. Hacktron, a security research firm, says that assumption is now failing. Its account of a compromise at OpenAI shows why.
The idea is simple. Complexity was never a real security control, but it acted like one. AI turns scarce expertise into computing power. The cost of an attack may be falling faster than many threat models allow for.
What Hacktron says happened
Hacktron reports that on July 25, 2026, it chained two vulnerabilities. The result was control of the ChatGPT accounts of several OpenAI employees. The first step was remote code execution, meaning it could run its own commands. The target was the Discourse forum software behind community.openai.com. From there, it reached employee accounts.
The team wanted to prove access without reading anything sensitive. It used one employee's Codex account to open a harmless pull request in OpenAI's internal code repository. Then it stopped testing. Hacktron says the whole path took under 72 hours.
Hacktron says OpenAI confirmed its side was fixed about 14 hours after the report. Discourse had a fix by the Monday after receiving its report on a Saturday. It then published advisory GHSA-vhm9-85gw-x335. OpenAI paid a $6,500 bounty. OpenAI told Hacktron that testing the Discourse-hosted forum was excluded from its program. The award covered only the OpenAI-side finding.
How the attack worked
The first flaw sat in an image library. Discourse normally checks uploads with a tool called FastImage. That tool did not support HEIC and HEIF, which are compact photo formats. So Discourse passed those files to ImageMagick, which used a library called libheif. A file parser now faced files chosen by an attacker.
Hacktron says libheif had a heap buffer overflow. This is a memory error that lets an attacker read and write outside safe limits. The code had been changed upstream the year before. That change was not marked as a security fix and got no CVE. Hacktron suggests this may be why Debian 12 and 13 were slow to backport it.
Discourse's image ran Debian 12 with libheif 1.19.7. Debian 13 still shipped 1.19.8 at the time.
The second flaw was in OpenAI's sign-in setup. Hacktron calls it an SSO misconfiguration. SSO means one login serves many services. Hacktron says the problem was not specific to Discourse. Any compromised OpenAI service using that sign-in could have led to the same access.
What the AI changed
Hacktron says Opus 4.8 built a working exploit on July 24, but only with ASLR switched off. ASLR randomises where code sits in memory, which makes exploits harder. Several sessions failed to get past it. Anthropic released Claude Opus 5 that evening. Hacktron says a fresh session then produced a working exploit within hours.
Hacktron also says the model refused to write exploits for remote targets. The team routed its own test server through a proxy so it looked like a capture-the-flag game. That is a reported detail. It suggests a safeguard can be sidestepped by how a task is framed.
Hacktron's wider HEIF Heist research covered Slack, Meta, GitHub Enterprise and others. The firm says it took two months, three researchers and under $3,000 in tokens. It says adapting to each company took one or two days.
Hacktron knows of only one company that noticed the probing. That was Shopify. Thousands of test images arrived and image workers crashed again and again. Nobody else, as far as Hacktron knows, reacted.
Hacktron adds that this was not fully autonomous hacking. Skilled human guidance still mattered. These are the firm's own findings. They have not been independently verified here.
Questions for your security team
First, ask where users can upload images or documents. Then ask which libraries read them. Hacktron says any application that accepts .heic, .heif or .avif files is highly likely to be affected. It names Next.js, Astro and Gatsby among the frameworks that depend on libheif.
Second, ask how patches reach you. A fix with no CVE may never show up in a scanner. Hacktron advises reading your distribution's security advisories. Packages can carry backported fixes under older version numbers.
Third, check any self-hosted Discourse. Hacktron says to run git pull, then ./launcher rebuild app from /var/discourse. Updating only through the web screen may leave the old container image in place.
Fourth, ask whether image processing runs in an isolated, short-lived sandbox. Ask whether unneeded HEIF and AVIF decoding is switched off. Fifth, ask how far one compromised service reaches through single sign-on. Last, ask whether anyone would notice thousands of crashing uploads.
The lesson is not that one forum was weak. The gap between a quiet fix and a working attack may be shrinking. Defenders need to close it first.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Hacktron AI.
