HEIF flaw let Hacktron reach limited GitHub access through OpenAI’s forum

Hacktron, a security firm, disclosed that it conducted a vulnerability investigation for OpenAI’s bug bounty program in under 72 hours. The rapid timeline highlights both the urgency of the issue and the efficiency of the coordinated disclosure process.

Entry point through the community forum

The initial breach vector originated from OpenAI’s community forum, which is built on the Discourse platform. This forum employed a vulnerable version of the libheif library to process HEIC and HEIF image formats, creating a surface for exploitation.

The specific flaw was identified as CVE-2026-32882, a buffer‑overflow vulnerability in libheif. The vulnerability received a CVSS score of 8.8, indicating a high severity level and the capability to achieve remote code execution when a crafted image was uploaded to the forum.

Leveraging AI models for exploit development

To adapt the exploit to the server’s architecture, the researchers first employed Claude Opus 4.8. This model assisted in generating the initial payload for the ARM64 environment. Subsequent use of Claude Opus 5 enabled refinement of the exploit for the x86‑64 architecture, demonstrating how generative AI can accelerate the adaptation phase of an attack.

The AI‑assisted workflow did not eliminate the need for human analysis. Researchers still had to interpret model output, validate the payload, and integrate it with manual testing steps, underscoring the continued relevance of expert oversight.

Escalation via single sign‑on weaknesses

After compromising the forum server, the team discovered a weakness in the single sign‑on (SSO) mechanism that linked the forum to other OpenAI services. By exploiting this SSO flaw, they were able to assume control of several ChatGPT accounts belonging to OpenAI employees.

One of the compromised accounts was associated with Codex and had permissions linked to OpenAI’s GitHub organization. This connection allowed the attackers to open a harmless pull‑request without needing to read the internal source code, illustrating a lateral movement path that relies on credential chaining rather than direct code access.

• The forum’s use of a vulnerable libheif version
• CVE‑2026‑32882 with a CVSS of 8.8
• AI‑assisted payload generation for ARM64 and x86‑64
• SSO weakness enabling control of employee ChatGPT accounts
• Codex‑linked GitHub access used to submit a benign pull request

The sequence of actions—from initial image upload to SSO exploitation and GitHub interaction—demonstrates a multi‑stage attack chain where each step builds on the previous one, magnifying the impact of the original buffer overflow.

Hacktron reported the vulnerability to OpenAI on July 25. OpenAI acknowledged the report and deployed a fix approximately fourteen hours later, indicating a swift remediation effort.

The incident was formally closed on September 1, after the patch had been validated and the bug bounty reward of $6,500 was paid, as noted by Bright. The payout reflects the monetary incentive structure typical of bug bounty programs.

While the financial reward and rapid patching illustrate a functional security response, the episode also raises questions about the broader risk landscape. For example, the reliance on third‑party libraries such as libheif may introduce systemic vulnerabilities across many services that share the same component.

Another open question concerns the extent to which AI models can autonomously discover and weaponize similar flaws. The current case shows that AI can accelerate exploit development, but human expertise remains essential for interpreting and executing the final steps.

Future investigations could examine whether integrating automated static analysis of third‑party dependencies into CI pipelines would reduce the window of exposure for vulnerabilities like CVE‑2026‑32882.

Overall, the incident underscores that while AI tools may speed up certain phases of an attack, they do not eliminate the need for rigorous security hygiene, thorough dependency management, and robust authentication mechanisms.