A forum image upload carried Hacktron's researchers into OpenAI's internal GitHub

A community forum tends to sit with support or marketing, and the upgrade schedule belongs to whoever runs the Discourse instance. According to Hacktron AI, the image upload box on OpenAI's forum was the first step in a chain that ended inside the company's internal GitHub environment ^[1][5].

The bug was old news to the people who maintain the library. libheif's developers fixed it about a year before Hacktron's researchers went looking, and Discourse did not implement the patch, so OpenAI's forum stayed on vulnerable code ^[10]. A malicious upload triggers a buffer overflow. An attacker can then edit program data that is normally out of reach and replace it with code of their own ^[9]. SiliconANGLE reports that the series spread so widely because libheif's developers did not create an entry in the CVE database, making vulnerable systems harder to detect and patch ^[13]. Hacktron calls the series HEIF Heist and says it found the same bugs at Slack, Meta Platforms and other large tech firms ^[6].

The first version of the exploit worked in Hacktron's own Discourse instance and failed against OpenAI's forum, which uses ASLR to spread sensitive program data across randomized memory locations ^[11][12]. That was June 23, built with Claude Opus 4.8 ^[11]. The next day Anthropic released Claude Opus 5, and the model found a way around OpenAI's ASLR implementation ^[19]. One day separated the failed attempt from the working one ^[20].

OpenAI employees' forum accounts run through the same SSO system that manages staff access to sensitive internal systems, and Hacktron found a configuration issue in it ^[3]. The researchers notified OpenAI about three hours after compromising the forum, then took over an employee account to map the scope, so the disclosure came before the GitHub access ^[14][16]. Sources told the Wall Street Journal that the repository contains "OpenAI's algorithmic secrets" ^[4]. The files were reachable until June 24, the day Hacktron reported, and OpenAI shipped a patch within 14 hours of the tip ^[17][18].

The upstream fix had been available for about a year, roughly 8,760 hours, and nothing in the path applied it; once told, OpenAI closed the exposure in 14 hours, about 625 times faster ^[21]. The year went to a dependency upgrade the vendor had not shipped ^[10].

In this case the forum was the reachable surface, and the identity system behind it was the reason the surface led somewhere ^[3][5].

Anyone doing this inventory on Monday can sort an estate on two conditions: whether a property authenticates staff through the same identity provider as internal systems, and who applies patches to its dependencies, us or a vendor. The properties answering "yes" and "a vendor" go first, because the team controls neither the way in nor how far in goes. The available moves there are dull ones: separate identity for public properties, and fewer things done to an uploaded file. Hacktron's advice to affected users is to move to the latest libheif and to harden or disable their image processing pipelines ^[15].