HacktronAI researchers chain libheif flaw and SSO failure to take over OpenAI employee accounts

Security research team HacktronAI has disclosed an exploit chain that let attackers seize ChatGPT and Codex accounts belonging to OpenAI employees through the company’s community forum. The attack combined a known memory-corruption bug in the libheif image library with a breakdown in OpenAI’s single sign-on system, ultimately exposing connected services including GitHub, Slack, Gmail, Google Drive and Outlook.

From HEIF to RCE

The chain started with a malicious HEIF file uploaded to community.openai.com, which runs on Discourse. ImageMagick processed the upload and invoked libheif, triggering a heap-overflow vulnerability that had already been patched upstream — but the fix was not tagged as security-relevant, so it never reached the version Discourse ships. The result was remote code execution on the forum server.

SSO failure widens the blast radius

The second, more severe flaw lay in OpenAI’s SSO implementation. Attackers used the forum foothold to pivot into the ChatGPT and Codex accounts of anyone who had logged in via the forum, including OpenAI staff. Because a number of those accounts were linked to external services, the compromise reached far beyond the chatbot itself.

Proof of concept and responsible disclosure

To demonstrate access without exposing sensitive code, the researchers used an employee account tied to OpenAI’s GitHub organization and opened a harmless pull request in the internal monorepo. They reported the issues separately: OpenAI patched the SSO flaw in roughly 14 hours; Discourse acknowledged the report on Sunday and shipped a fix on Monday. OpenAI awarded the team a $6,500 bounty.

AI models did much of the exploit engineering

Language models played a central role in building the chain. According to the researchers, Anthropic’s Opus 4.8 located the libheif vulnerability and produced a partial exploit; hours after Opus 5 launched, the model had adapted the exploit for Discourse and achieved RCE in a test environment. Their takeaway: AI is collapsing the rare expertise required for exploit development, compressing months of work into days.

Wider impact: “HEIF Heist”

The months-long investigation, dubbed “HEIF Heist,” found that the libheif flaw affects a long list of applications and platforms — among them Slack, GitHub Enterprise, Meta, Rails, Next.js and ImageMagick itself. The team plans to publish technical details for each affected vendor over the coming weeks on the HacktronAI blog. In Slack alone, they say, the RCE could have leaked files uploaded by any user.

Architecture and speed

“Even leading AI labs can be vulnerable,” the researchers concluded. “Defenders need to fix architecture, patch faster, and limit blast radius.” Full details of the exploit chain and the discovery process are on the HacktronAI blog.