What went down

Imagine a public help forum, an image you shouldn’t trust, and a login system that treats the forum like a cozy family member. Three security researchers at a firm called Hacktron stitched those things together and, for the purposes of responsible research, walked right into an OpenAI staff account. They didn’t steal secrets — they made a harmless pull request to prove access and then stopped — but the chain was real and scary fast: the whole internal access sequence took under 72 hours.

The root cause started with an image-processing problem in the forum software. Discourse handed uploaded HEIC/HEIF images to a library called libheif, and a specially crafted image could make the image reader spill memory. That leaked memory made it possible to bypass a common defense called ASLR, and the researchers combined these memory quirks to turn a crash into working code execution on the forum server.

Why did a forum break into staff accounts? Because the forum used the same single sign-on system that OpenAI employees used elsewhere. Once the researchers controlled the forum server, that shared login let them assume the identities of forum members who happened to be OpenAI staff. No clicking, no phishing — just the shared trust model doing what it was designed to do, but in the wrong place.

There’s some silver lining: the team reported the issue, OpenAI fixed the underlying problem within about 14 hours of the report, and paid a small bounty of $6,500. The researchers avoided reading or exfiltrating source code or customer data; their pop of the hood produced a single, harmless pull request to prove the point.

How AI sped the ride and what you should do

Here’s the eyebrow-raiser: the researchers leaned on a new model called Claude Opus 5 to help turn memory leaks and crash info into a working exploit. Opus 4.x struggled, but Opus 5 produced a usable exploit much faster in a controlled test environment. The team stressed this wasn’t magic autopilot — human experts directed the work — but it did drastically shorten the time and skill needed to get from bug to a functional exploit.

That combination — image-decoding bugs in infrastructure plus shared logins — isn’t unique. The researchers ran a wider project hunting similar image-decoding weaknesses across other big services and found more instances where unpatched image libraries could lead to serious problems. In short: if you accept user images, you should be paying attention.

  • Update any image-decoding libraries to the latest, patched versions immediately (apply your distribution’s updates if you rely on packaged builds).
  • Where practical, turn off decoding of untrusted HEIF/AVIF images or process them inside a strict sandboxed environment.
  • Limit what your single sign-on trusts. Don’t let low-trust, public services share full staff credentials without extra verification.
  • Require a fresh identity check (re-auth or stronger step-up) before sensitive actions, rather than relying solely on an existing session.
  • Rebuild server images after critical library fixes; web app updates alone might not replace an old system library.

Final note: there’s no public sign this specific chain was weaponized in the wild. Still — the experiment is a tidy reminder that a bug in a public-facing piece of software plus shared authentication can quickly turn into a staff-wide problem. Patch the image pipeline, tighten SSO boundaries, and treat all third-party public services that share your identity system like they might be the weakest link — because they often are.