AI Made Exploit Development Cheap: How a Forum Image Upload Reached OpenAI’s Internal Code

For years, reliable exploits for memory-corruption bugs were a scarce resource, mostly spent by intelligence services and top criminal groups on high-value targets. A new report from the security firm Hacktron AI suggests that scarcity is ending. The firm describes how a small team, working with AI models, turned an obscure image-decoder bug into access to OpenAI’s internal code repository in under 72 hours, and then reused the same technique against a series of other large companies. Almost none of them noticed.

The operation in short

The research, published on September 13, 2026 and reported to OpenAI through its Bugcrowd bug bounty program, chained two weaknesses:

• A heap buffer overflow in libheif, a widely used HEIC/HEIF image decoder. OpenAI’s community forum runs on Discourse, whose Debian-based image carried a libheif version without the relevant fix. Uploading a crafted image gave code execution on the forum server.
• A misconfiguration in OpenAI’s single sign-on. Because forum users log in with their OpenAI account, control of the forum let the researchers take over the ChatGPT and Codex accounts of active members, with no action from the victims.

One of those accounts belonged to an OpenAI employee whose Codex agent was connected to OpenAI’s GitHub organization. Instead of reading internal code, the team prompted that agent to open a harmless pull request in OpenAI’s internal monorepo as proof, then stopped testing. OpenAI confirmed a fix roughly 14 hours after the report and paid a $6,500 bounty, noting that testing against the Discourse-hosted forum was outside the program’s scope. Discourse patched its side within three days and added sandboxing for image processing.

Why the decoder bug slipped through

The flaw had been fixed upstream a year earlier, but the change was never flagged as a security fix and received no CVE. According to Hacktron, that is likely why Debian 12 and 13 did not backport it in time. For intelligence-grade attackers this is a familiar pattern: silent fixes in upstream code leave long-lived, unlabeled vulnerabilities in downstream distributions, and those are exactly the gaps a patient adversary looks for.

AI turned expertise into compute

The most consequential part of the report is how the exploit was built. Claude Opus 4.8 found the missing backport and wrote a working exploit with ASLR disabled, but repeated sessions failed to make it reliable under realistic conditions. Hours after Anthropic released Claude Opus 5 on July 24, a new session succeeded, and an autonomous agent loop then achieved code execution on a Discourse test instance the team controlled. The team says the model refused to write exploits against remote systems, so they disguised their own test server as a capture-the-flag target. A guardrail that a researcher can sidestep with a proxy and a label will not stop a determined state actor.

Hacktron has since extended the work into a campaign it calls “HEIF Heist,” tracing libheif through Slack, Meta, GitHub Enterprise, Ruby on Rails and frameworks such as Next.js, Astro and Gatsby. Three researchers ran it for two months at a token cost below $3,000. Adapting the exploit to a new company, often without knowing the exact library versions or environment, took one or two days. The firm stresses that skilled humans still guided the work; this was accelerated, not fully autonomous, hacking.

The detection gap

For defenders, one line in the report should be alarming: Hacktron says it is not aware of any company that detected the activity except Shopify, even though thousands of images were sent and image processors crashed repeatedly. Crashing parsers are a classic sign of exploitation attempts. If large technology companies miss that signal during a noisy research campaign, a quieter, well-resourced intrusion would likely go unseen for much longer.

What changes in the threat model

• Capability diffusion. Hacktron argues that software was long protected by “security through complexity”: turning a public bug into a reliable exploit required rare expertise and months of work. AI compresses that into days, putting techniques once reserved for top-tier actors within reach of far smaller groups.
• Identity as the pivot point. The researchers emphasize that the escalation was an OpenAI SSO issue, not a Discourse one; any service using OpenAI sign-in could have served as the entry point. As users connect AI assistants to code, chat and email, one account takeover can expose a great deal of an organization.
• Agents as insiders. The proof of access was a prompt to a coding agent. Connected AI agents hold standing permissions that an attacker can direct without ever touching a password.

Defensive priorities

• Update libheif and libde265 (upstream libheif v1.23.4 as of September 14, 2026) and rebuild self-hosted Discourse installations.
• Disable untrusted HEIF/AVIF decoding where it is not needed and run image processing in isolated, short-lived sandboxes.
• Alert on repeated crashes in media-processing services; treat them as possible exploitation, not noise.
• Map every application that trusts your identity provider, and restrict what connected AI agents can do in code repositories.

Source: Hacktron AI, “Hacking OpenAI” (September 13, 2026). Discourse advisory: GHSA-vhm9-85gw-x335.