A three-person security team says it used Claude to turn an image-upload bug into access to OpenAI employees’ accounts in under 72 hours. The path ran through libheif, an image library that sits inside a great deal of ordinary business software, so image upload security belongs on your patch list this week.
- Hacktron says a heap overflow in libheif, reached through ImageMagick in a Discourse forum, gave it code execution on OpenAI’s community forum in July 2026.
- An OpenAI sign-in misconfiguration then let it take over employee ChatGPT and Codex accounts. OpenAI confirmed a fix about 14 hours after the report.
- Any site that accepts .heic, .heif or .avif uploads and runs an unpatched libheif may be exposed.
Most breach write-ups about AI labs are about the models. This one is about a photo format. In a disclosure dated September 13, 2026, security firm Hacktron says it chained a flaw in the libheif image decoder with a sign-in misconfiguration to reach OpenAI employees’ ChatGPT accounts, and used one employee’s Codex to open a harmless pull request in OpenAI’s internal code. The researchers say Anthropic’s Claude models wrote most of the exploit. Check which version you run against the libheif project’s releases before you assume a patch is in.
How the attack worked
According to Hacktron, the chain had four steps:
- OpenAI’s help forum runs on Discourse. Discourse passed HEIC and HEIF images to ImageMagick, which used libheif to decode them.
- The Debian 12 package of libheif in Discourse’s Docker image lacked a fix that had been made upstream the previous year without a CVE. Hacktron calls the result a heap buffer overflow.
- Claude Opus 5 turned that flaw into a working exploit through an image upload, after Opus 4.8 had failed across several sessions.
- Because the forum used “Sign in with OpenAI,” code execution on the forum led to takeover of ChatGPT and Codex accounts.
OpenAI’s comment, included in the post, says testing against the Discourse-hosted forum was outside its bug bounty scope, and that its award “recognizes the OpenAI-side finding.” Discourse had a fix ready within days and added sandboxing for image processing. Hacktron sells AI security testing, so its framing has a commercial interest; the technical details are specific enough for others to check.
What the researchers measured
Hacktron reports that the OpenAI work took “a few days for an agent, and just a few hours of human time,” and that a two-month campaign against several companies, including Slack, Meta and GitHub Enterprise, cost “less than $3,000 in tokens in total.” It also says only Shopify detected the activity, “even after thousands of images were sent and their image processors repeatedly crashed.” Those are the researchers’ own figures. No one else has published a replication.
We read the cost figure as the important one. Turning a memory bug into a reliable exploit used to need rare skill and weeks of work. If it now costs a few thousand dollars in tokens, small and mid-sized firms lose the protection they had from being too ordinary to bother with.
Who is exposed by weak image upload security
Hacktron says: “If your application processes user-controlled images and accepts .heic/.heif/.avif images, it is highly likely it is affected.” HEIC is the default photo format on iPhones, so customer portals, insurance claim forms, real estate listing tools and support sites that accept phone photos are the obvious places to look. Self-hosted Discourse users should rebuild their installation, since, per the post, a web-interface update alone may not replace the vulnerable package.
The fix advice is concrete. Update libheif through your distribution’s security channel or to a current upstream release (Hacktron lists v1.23.4 as the latest security release as of September 14), and check the package advisory, since distributions may backport fixes under older version numbers. Where you do not need HEIF or AVIF decoding, turn it off, or run image processing in an isolated, short-lived sandbox.
What we ran and what we didn’t: we read the full disclosure and checked the quoted passages. We did not test any exploit, scan any system or confirm the affected version list.
The Limitation
The disclosure tells you the bug class and the patched version. It cannot tell you whether a library buried inside your website plugin, form builder or hosted portal includes libheif at all. That depends on each vendor’s build, and most small firms have no list of the image libraries their software ships. A software bill of materials from each vendor would close that blind spot.
What would change our mind
If Debian and the other major distributions confirm patched libheif packages across all supported releases, and the hosted platforms you use confirm they are patched, this becomes routine maintenance rather than a priority. Debian had shipped its Debian 13 fix on August 8, 2026, according to Hacktron; check your own vendors’ notices for the rest.
The patch habit in this piece pairs with the key controls in AI API key security, since a compromised account with connected AI tools reaches further than it used to. Our AI agent incident plan covers what to do when an agent misbehaves inside your own systems. More tool coverage is in AI Tools and Reviews and our AI for business guide.
Buyer’s test
List every website, portal and app your company runs that accepts photo uploads from customers or staff. For each, ask the vendor or your developer two questions in writing: does it decode HEIC, HEIF or AVIF, and which libheif version does it ship? Pass if every system has a written answer and none runs a version older than the patched release. One week, because vendors are slow.
FAQ
How was OpenAI hacked through its forum?
Hacktron says it exploited a libheif image-decoding flaw in OpenAI’s Discourse forum, then used a sign-in misconfiguration to take over employee ChatGPT and Codex accounts. OpenAI fixed its side within about 14 hours.
What is libheif?
It is an open-source library that decodes HEIF, HEIC and AVIF images. Many image tools, including ImageMagick, use it to process uploaded photos.
How do I know if my website is affected?
Check whether it accepts HEIC, HEIF or AVIF uploads and which libheif version it uses. Hacktron lists v1.23.4 as the latest upstream security release as of September 14, 2026.
