Chained libheif flaw and SSO weakness exposed OpenAI staff accounts
Three researchers at security firm Hacktron used Anthropic’s Claude Opus 5 to chain an image-processing vulnerability with an OpenAI login weakness, taking control of the ChatGPT and Codex accounts of several OpenAI employees and reaching an internal code repository. The work was security research: the team made one harmless pull request to prove access, did not read source code or customer data, and stopped.
Hacktron said the initial access took less than 72 hours. OpenAI fixed the OpenAI-side finding about 14 hours after the report, according to the researchers, and paid a $6,500 bounty on September 1. OpenAI said the award recognised its own finding rather than activity against Discourse, which was outside its bug bounty scope.
Public forum compromise became an identity risk
The public help forum ran Discourse and offered “Sign in with OpenAI.” Once the researchers controlled the forum server, that shared single sign-on relationship let them access forum members’ ChatGPT and Codex accounts when those members worked at OpenAI. Hacktron said the affected employees did not need to take any action.
The significance lies in the trust boundary. A lower-trust, internet-facing service shared an authentication path with employee accounts used elsewhere. The account access could theoretically have extended to connected services such as GitHub, Slack and email, although Hacktron said it did not use that wider reach. The account-takeover chain described by OpenAI account takeover through chained flaws illustrates how a public-facing service can become consequential when it relies on the same identity system as sensitive tools.
libheif version and image pipeline details
The entry point was CVE-2026-32882, a flaw in libheif, the library ImageMagick uses to process HEIC and HEIF images. Discourse passes uploaded images to ImageMagick. Discourse rated the issue as remote code execution with a score of 8.8, while libheif’s advisory and national vulnerability databases describe an out-of-bounds read that can crash software or disclose nearby memory.
Hacktron said it combined libheif memory bugs, with AI assistance, to bypass ASLR and obtain working code execution on the forum server. The upstream fix arrived in libheif 1.22.0 in May 2026, but the Debian 12-based forum image still contained version 1.19.7 when the researchers assessed it in July.
AI accelerated, but did not replace, researcher control
The team initially used Claude Opus 4.8 and struggled to develop an exploit with ASLR enabled. After Anthropic released Claude Opus 5 on July 24, the researchers said a fresh session generated a working exploit within hours. They used an automated loop against their own test server presented as a capture-the-flag target, but said skilled human direction remained necessary.
For self-hosted Discourse deployments, rebuilding on a current image matters because updating the web interface alone may not replace an old library. The fixed self-hosted releases are 2026.7.0, 2026.6.1, 2026.5.2 and 2026.1.6; Discourse-hosted sites were already patched.
Practical implications for security teams
Organisations that accept HEIC, HEIF or AVIF uploads should update libheif to the latest security release or their distribution’s patched build. Where such decoding is unnecessary, it can be disabled; otherwise, image processing can be isolated in a restricted sandbox.
Teams should also limit which services their single sign-on trusts and require a fresh identity check before sensitive actions rather than relying solely on an existing session. In practice, patching a vulnerable image-processing component and reviewing SSO trust relationships must be treated as a single business risk.