Hacktron chained a Claude-written libheif exploit into OpenAI's internal repositories

Researchers at security firm Hacktron used Claude to build a working exploit for a vulnerability in an image-processing library, then chained it with a flaw in OpenAI's sign-in system to take over employee ChatGPT and Codex accounts and gain access to internal code repositories.

Turning the libheif flaw into a reliable exploit took several attempts and involved Claude Opus 4.8 and Opus 5; the exploit allowed remote code execution, which the researchers first used against a test Discourse instance and then on OpenAI's own forum.

The entry point was community.openai.com, which runs on Discourse; Discourse's built-in image checks did not support the HEIC/HEIF format, so uploads in that format were passed to ImageMagick, exposing an unpatched flaw in the libheif library it relies on for decoding.

To demonstrate the access without reading internal code, Hacktron says it took over an OpenAI employee's account whose Codex integration was linked to OpenAI's GitHub organization, then used it to open a pull request in an internal repository before stopping further testing.

Since people often connect other services to their OpenAI accounts, the theoretical exposure extended to services like GitHub, Slack and email.

Hacktron's report raises Slack as a service that could theoretically have been reached through connected accounts; OpenAI says Hacktron did not verify actual access to employee Slack messages.

The security firm reported the account-takeover issue to OpenAI through Bugcrowd, and OpenAI confirmed a fix about 14 hours later.

Hacktron separately reported the libheif flaw to Discourse through HackerOne; Discourse had a fix ready within two days, added image-processing sandboxing as an extra layer of defense, and published a security advisory.

OpenAI paid Hacktron a $6,500 bounty for the OpenAI-side finding.

OpenAI said its own review of the incident found limited reads of private-repository metadata and commits, followed by the researcher-submitted pull request, specifically to a README file.

In a statement, OpenAI said, "We thank the researchers for contacting us and sharing their findings. We narrowed the permissions on Community sign-in tokens and revoked affected tokens and sessions."

Closing the single attack chain required two separate disclosure programs: Bugcrowd for OpenAI's sign-in token permissions and HackerOne for the libheif exposure in Discourse.

The exposure arises wherever an upload validator supports fewer formats than the downstream decoder: unrecognised formats are passed through to the library rather than rejected.

Hacktron says the underlying libheif bug had been fixed upstream a year earlier without ever being flagged as a security issue, so it was never assigned a CVE and missed the usual patching cycle.

Because the upstream libheif fix was never labeled a security issue and never received a CVE, a patch program that matches on CVE identifiers had no record to match, leaving downstream consumers of the older library version without an upgrade signal.