Researchers Used Claude to Hack OpenAI Through an Image Flaw

HEIF Heist is a class of remote code-execution attacks that abuse the native image decoders libheif and libde265 to compromise almost any web service that processes an attacker-supplied HEIF, HEIC or AVIF image. Security firm Hacktron AI, led by Harsh Jaiswal, used the technique to reach internal systems at OpenAI, Slack, Meta, Discourse, Next.js and GitHub Enterprise, and to leak AWS access tokens across several applications.

The most fully documented link in the chain is CVE-2026-32882, a heap buffer overflow in libheif rated CVSS 8.8, which Hacktron used to gain code execution on the Discourse forum at community.openai.com. A malformed HEIC upload slipped past Discourse’s image checks and reached ImageMagick’s HEIF path, where out-of-bounds read/write primitives during decoding turned a picture upload into a shell — and from there into an OpenAI employee account takeover.

How HEIF Heist Works

The vulnerable surface sits below the application, inside the C/C++ parsers that libheif and libde265 expose. Those decoders rarely appear in a dependency list directly; they arrive bundled through wrappers like ImageMagick, libvips and Sharp, through standard distribution packages, and inside prebuilt container base images. Discourse validated uploads with FastImage, and because FastImage does not understand HEIF, it handed HEIC and HEIF files straight to ImageMagick for conversion, exposing the raw parser to attacker-controlled bytes.

Hacktron found that Debian 12 and 13 had never back-ported the relevant libheif fix — the upstream change carried no CVE — so the Discourse Docker image shipped the vulnerable libheif 1.19.7. An attacker can fingerprint the libheif version behind an upload endpoint with crafted files, then fire a version-matched payload to trigger memory corruption, data disclosure or RCE.

Which Products and CVEs Are Affected

GitHub’s own advisory describes CVE-2026-19118 as a race condition that swaps a validated upload for attacker-controlled content before processing; Hacktron files it under the HEIF Heist set. Vercel, meanwhile, disabled AVIF optimisation on its managed service rather than wait for a fixed libheif build.

How the OpenAI Breach Happened

The forum RCE was only the entry point. Hacktron says the escalation relied on a misconfiguration in OpenAI’s single sign-on, which turned control of any OpenAI SSO-connected service into access to ChatGPT and Codex accounts. Using one employee’s Codex, connected to OpenAI’s GitHub organisation, the team opened a harmless proof-of-concept pull request in OpenAI’s internal monorepo and then stopped. OpenAI paid a $6,500 bounty through Bugcrowd and later clarified that the award covered the SSO finding, because testing against the Discourse-hosted forum was out of scope. The path from the first probe to repository access took under 72 hours.

How AI Cut Exploit Time to Days

Hacktron built the exploits with frontier models. Claude Opus 4.8 struggled across several sessions to produce a working exploit with ASLR enabled; hours after Anthropic shipped Claude Opus 5, the same prompt produced a working ARM64 exploit in about three hours, which the team ported to Discourse’s x86-64 and jemalloc layout.

Because the model refused to write a remote exploit against a live target, the researchers proxied their own instance to look like a CTF box before running it in an autonomous loop. Across the wider campaign, they leaned heavily on OpenAI’s GPT-5.6 Sol. The full project ran for two months, cost under $3,000 in tokens, and adapted to each new target in a day or two — work that, in Hacktron’s words, can now be “compressed into days.”

Has It Been Patched?

Every named vendor has shipped fixes; the table above lists them. Upstream, move libheif to v1.23.2 or later — v1.23.4 is the latest security release as of mid-September 2026 — with flaws spanning the 1.19.x through 1.23.x families. Where HEIF and AVIF decoding is not needed, disable it; where it is, isolate image processing in a hardened, ephemeral sandbox, as Discourse now does. One detection signal stands out: across thousands of malicious uploads, only Shopify was noticed, flagged by image processors that repeatedly crashed on upload endpoints.