"From the first look, that internal access took under 72 hours."
CVE-2026-32882: how an image bug led to a server breach
Three researchers at the security firm Hacktron used a chain of flaws beginning with an image-processing bug to take over several OpenAI staff accounts and reach an internal code repository. The initial flaw appeared in libheif, the library used to parse HEIC and HEIF images. libheif's advisory and national vulnerability databases describe CVE-2026-32882 as an out‑of‑bounds read that can crash software or leak nearby memory. Discourse, the open-source forum software that runs OpenAI's public help forum, rates the result as remote code execution and scores it 8.8/10.
Discourse passes uploaded HEIC and HEIF images to ImageMagick, which calls libheif. A specially crafted image corrupted the forum server's memory. The libheif fix (upstream) shipped in version 1.22.0 in May 2026, but the forum's server image — built on Debian 12 — still ran the older libheif 1.19.7 when Hacktron examined it in July. Discourse-hosted sites had already been patched; self-hosted Discourse users needed to rebuild server images or upgrade to the fixed releases (2026.7.0, 2026.6.1, 2026.5.2, and 2026.1.6).
Claude Opus 5 and the exploit chain
The researchers combined the memory-leak behavior in libheif with automated help from an AI model to transform a crash into working code execution on the forum server. They first tried Anthropic's Claude Opus 4.8, which struggled to build a working exploit once ASLR — a common memory-protection mechanism — was enabled. Anthropic released Claude Opus 5 on the evening of July 24; in a fresh session Opus 5 produced a working exploit within hours.
Opus 5 shipped with safeguards intended to block exploit generation. Hacktron bypassed those safeguards by pointing the model at their own test server, disguised as a capture‑the‑flag practice target, and running it in an automated loop. The team emphasized the work required skilled human direction and was not an unattended, automated hack.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageWhat the researchers reached, and what they did not touch
The chain did not stop at the forum. OpenAI's forum offers a "Sign in with OpenAI" single sign‑on (SSO) option — the same SSO staff use for ChatGPT and Codex. Once the researchers took control of the forum server, the shared login allowed them to take over ChatGPT and Codex accounts of forum members who worked at OpenAI without any action by the victims.
Hacktron reported the flaws to OpenAI, proved the access with a harmless pull request triggered by opening one employee's Codex link to OpenAI's code on GitHub, and then stopped. They did not read source code, merge or ship anything, or access customer data. OpenAI fixed the issue about 14 hours after the report, according to Hacktron, and on September 1 paid the team a $6,500 bounty. OpenAI said the award "recognizes the OpenAI-side finding, not the actions against Discourse." OpenAI has not publicly described the login flaw; it confirmed the finding by fixing it and issuing payment rather than detailing account takeovers.
HEIF Heist: the wider campaign and corroboration
Hacktron calls the project HEIF Heist and says it ran for about two months, finding the same class of image-decoding flaws in software used by other large companies at a total AI-cost under $3,000. The researchers link the campaign to reported bugs in Slack, Meta's products, GitHub Enterprise, and web frameworks such as Next.js.
The broader claims are unevenly corroborated. Vercel confirmed the Next.js flaw in its advisory, and libheif's maintainers confirmed a working code-execution exploit for the bug tied to Meta. The Hacker News noted that claims of code execution across many applications have not been independently confirmed. For targets where the team had no prior knowledge, Hacktron used OpenAI's GPT-5.6 Sol; the researchers say only Shopify appears to have noticed repeated crashes from thousands of test uploads.
What this means for technologists, enterprises, and policymakers
- Technologists and security teams: Rebuild server images to include the patched libheif (upstream fixed in 1.22.0; update to 1.23.4 or your distribution's patched build as of early September 2026). Where possible, turn off decoding of untrusted HEIF/AVIF files or run image processing inside a sandbox.
- Enterprises and procurement leaders: Treat shared single sign‑on trust as a blast radius. If a public, lower‑trust service shares SSO with internal tools, compromise of the public service can grant access to internal accounts. Limit which services your SSO trusts and require fresh identity checks before sensitive actions rather than relying on existing sessions.
- Policymakers and regulators: The case illustrates that capable AI models are sharply cutting the time and skill once required for serious offensive work, a dynamic Anthropic has reported in relation to criminal and state‑backed misuse. That change affects vulnerability exploitation timelines and the operational pressure on patching and incident response.
There is no sign the OpenAI flaw was used in the wild. As of mid‑September 2026 it was not on the U.S. government's list of vulnerabilities known to be exploited, though that absence is not definitive proof none occurred. The Hacktron exercise is a clear illustration: a publicly available image parser flaw, an unpatched server image, and an AI model with exploit‑building capability can be chained into a rapid, impactful escalation — and fixing the chain depended on cooperation between researchers and the vendor.
