What actually happened (short, geeky recap)

Think of this as a ridiculous heist movie where the getaway car is a picture file and the mastermind is an AI. Three security researchers from Hacktron chained two separate weaknesses to take over several staff accounts at a major AI company: a vulnerability in a public forum’s image handling and a shared login system that staff also used elsewhere. This was ethical security research — they reported it, opened a harmless proof pull request, and stopped before doing anything damaging.

The timeline was weirdly fast. From initial foothold to internal-access proof took under 72 hours, the company pushed a fix around 14 hours after being notified, and a modest bounty of $6,500 was awarded. No customer data was touched and no secret code was exfiltrated during the demo.

Why this mattered: that forum offered the same single sign-on used by staff. Once the researchers controlled the forum server, that shared login let them impersonate employees on services tied to the same identity provider — meaning ChatGPT and Codex accounts became accessible without the victims doing anything.

How the chain worked and what to learn (no PhD required)

Here’s the simplified attack chain, told like a drip-feed of chaos:

  • An image-upload flow on a Discourse forum passed HEIC/HEIF images to ImageMagick, which used the libheif library to decode them.
  • A bug in libheif allowed a specially crafted image to misbehave — leaking memory or crashing the process. That memory leak helped attackers defeat address-randomization defenses.
  • With iterative tinkering and AI assistance, the team turned that leak into working code execution on the forum server.
  • Because the forum used the same sign-on as staff tools, the attacker could exchange that server control for staff sessions and access accounts like ChatGPT and Codex. The team proved it with a single innocuous pull request in an internal repo and stopped there.
  • Crucially: the exploit development was accelerated by a modern AI model. Earlier model versions struggled; a newer release produced a working exploit in a fresh session and sped the craft considerably — although humans still guided and checked everything.

Upstream fixes for the image library existed earlier, but the forum’s server image was still running an older library build from the underlying distribution. That gap between upstream patch and deployed package is how an already-fixed bug was still exploitable in the wild.

There are some broader, unsettling possibilities: because staff accounts can connect to other services (code hosting, chat, email), the same chained approach could in theory reach a lot more than just a forum and two web apps — which is why this being a controlled research test matters.

What you should do right now

If you run a forum, image processor, or any service that accepts HEIF/AVIF/HEIC uploads, don’t be smug. Fixes and mitigations:

  • Update libheif to the latest security release or to your distribution’s patched package — rebuilding images may be required to replace an old library.
  • Disable decoding of untrusted HEIF/AVIF when you don’t need it, or process images inside a strongly sandboxed environment.
  • Limit trust relationships for your single sign-on and require fresh identity checks for sensitive operations instead of blindly reusing sessions.
  • Audit deployed server images and container builds for stale libraries; a UI update won’t always replace underlying system packages.

Also: treat AI as a turbocharged assistant. Current models can sharply reduce the time and skill required to craft exploits, but they don’t magically replace expert oversight. Responsible testing, tight boundaries, and rapid disclosure remain the right playbook.

Final nuance: there’s no indication this particular chain was weaponized in the wild. Whether already-patched orgs should hunt for past access is not clearly answered in public reports — if in doubt, do a forensics sweep.