By ByteBot
Security team Hacktron AI published a full technical writeup today showing they breached OpenAI’s internal code repository by chaining a year-old heap overflow in libheif with an OpenAI SSO misconfiguration—and used Claude Opus 5 to break ASLR in three hours when every earlier model had failed. The attack started with a single HEIC image uploaded to OpenAI’s public forum. It ended with write access to OpenAI’s internal monorepo. The whole chain took 72 hours.
The story runs on three tracks simultaneously: a forgotten “silent” upstream patch left a widely deployed C library exploitable for over a year; an SSO trust failure meant that compromising a public forum gave pivot access into core employee toolchains; and Claude Opus 5 demonstrated, in production and on a live target, that frontier AI can now autonomously generate working ASLR bypasses. None of these are theoretical anymore.
From HEIC Upload to OpenAI’s Internal Monorepo in 72 Hours
The entry point was Discourse’s image upload pipeline. Discourse’s FastImage utility doesn’t support HEIC, so it delegates to ImageMagick’s magick command, which calls the underlying libheif decoder. The version running on OpenAI’s forum—libheif 1.19.7 on Debian 12—contains a heap buffer overflow during HEIC decoding that grants out-of-bounds read/write primitives. That’s code execution waiting to happen. According to the full technical writeup, the attack chain reads like this:
HEIC upload → FastImage (no HEIC support) →
ImageMagick → libheif 1.19.7 OOB R/W →
Container RCE → SSO token hijack →
Employee Codex account → openai/openai (internal monorepo)Once researchers had container-level code execution on the Discourse server, they exploited OpenAI’s “Sign in with OpenAI” SSO integration at auth.openai.com. The SSO system didn’t enforce zero-trust isolation between integration partners—meaning a compromised forum server could intercept token exchange flows and hijack active employee sessions. Compromised Codex access let them open PR #1186742 in OpenAI’s internal monorepo as proof of access. OpenAI fixed the SSO issue in approximately 14 hours and awarded a $6,500 bounty for the SSO finding. The Discourse forum was explicitly out of scope for the bug bounty program—which means the initial RCE vector went unrewarded.
The Model That Broke ASLR
Hacktron AI had a working exploit with ASLR disabled. Getting it to work reliably against production systems—with jemalloc’s heap structures complicating the overflow—was a different problem. Earlier AI models couldn’t solve it. Then Claude Opus 5 shipped. As documented in Hacktron AI’s blog, within three hours of Opus 5’s release it produced a working ARM64 payload that bypassed ASLR, then autonomously adapted it to x86-64, then confirmed RCE on the live Discourse Cloud server by reading /etc/hosts. The model operated in a goal-directed loop without manual guidance at each step.
This is the first publicly documented case of a frontier AI model generating a production ASLR bypass autonomously—not as a capture-the-flag exercise but against a live target running a real organization’s infrastructure. The capability gap between Opus 4 (which failed) and Opus 5 (which succeeded in three hours) is now a matter of public record. Defenders don’t have governance-free access to frontier models. Attackers do.
The Patch That No One Knew Was a Security Fix
The upstream libheif fix for this vulnerability landed over a year before the attack. Commit 85e21ad44 was described as “simplify overlay overlap area computation.” No CVE was filed. No security advisory was issued. Debian never flagged it as a security-critical backport. The patch was public—it was sitting in the git log the entire time—but every downstream consumer, including Debian maintainers and Discourse’s container builds, had no signal that it was security-relevant.
This is the silent patch failure mode, and it’s not unique to libheif. As SecurityWeek noted, “silent patches fail to keep vulnerabilities secret from skilled adversaries who can reverse-engineer changes, leaving defenders without critical context.” Attackers can read git logs. Defenders need CVEs and security advisories to route patches through their vulnerability management systems. Without those signals, a fixed vulnerability is functionally a zero-day for any downstream consumer who hasn’t manually audited every upstream commit. Debian eventually released DSA-6417-1 in August 2026—a full month before this writeup went public.
Three Things to Fix Before Monday
Check your libheif version first. On Debian or Ubuntu, run dpkg -l libheif*. Debian 12 systems running version 1.19.7 need DSA-6417-1 immediately. Debian 13 users on version 1.19.8 should check for the updated package. Any self-hosted Discourse instance on a Debian base is potentially affected.
Next, sandbox image processing. The root cause here is that user-uploaded images went directly to a complex C decoder without process isolation. A commenter on the Hacker News thread put it plainly: “HEIF also supports rotating, cropping, alpha channels, thumbnails and a ton of other features that a web forum doesn’t need.” Run ImageMagick and libheif in an isolated container, or convert uploads client-side to JPEG before they reach the server. Either approach stops the chain at step one.
Finally, audit SSO trust scopes. A “Sign in with [Provider]” integration for a public forum should have no ability to access internal toolchains, admin sessions, or high-privilege services. SSO integration partners are an attack surface. If a compromised partner can pivot into employee accounts for internal tools, the scope of an external forum compromise becomes the scope of your entire connected employee toolchain. Scope integration partners explicitly, and enforce re-verification for privileged operations regardless of SSO session state.
Key Takeaways
- The attack chain ran: crafted HEIC → libheif heap overflow → container RCE → SSO pivot → OpenAI internal monorepo write access. Two bugs, 72 hours, one internal monorepo.
- Claude Opus 5 autonomously generated a production ASLR bypass in three hours—something no earlier model could do. AI-assisted exploit development is no longer theoretical.
- The libheif fix was public for over a year with no CVE, leaving every downstream consumer blind to its security relevance. Silent patches are a systemic risk in the open-source supply chain.
- Check libheif version now (
dpkg -l libheif*), sandbox image processing pipelines, and scope SSO integration partners with explicit zero-trust. Any one of these would have broken the chain.
