HEIF Heist: How Researchers Chained libheif RCE and OpenAI SSO Flaw to Infiltrate Internal Repositories

In one of the most consequential security research disclosures of 2026, offensive security research firm Hacktron AI has published the full anatomy of the "HEIF Heist"—a multi-stage exploit chain that allowed researchers to breach OpenAI's internal monorepo (openai/openai) and take over employee ChatGPT and Codex developer sessions. By chaining an unpatched heap buffer overflow in the open-source libheif image decoding library running inside OpenAI's community forum with a Single Sign-On (SSO) identity federation vulnerability on auth.openai.com, researchers traversed from a zero-privilege image upload on a public web application straight into OpenAI's private GitHub organization in under 72 hours.

The Exploit Architecture: From Image Upload to Monorepo PR

The vulnerability chain traversed four discrete operational tiers, transitioning from low-level C++ memory corruption in an image conversion utility to high-level cloud identity manipulation and internal developer tooling integrations. The diagrammatic execution flow demonstrates how perimeter decoupling broke down across the trust boundary:

Deep Technical Breakdown: The libheif Heap Corruption Primitive

The initial vector of the compromise resided inside the media processing pipeline of Discourse. By default, Discourse processes uploaded user imagery through a lightweight Ruby utility named FastImage to rapidly validate dimensions, MIME types, and file structure without loading full image rasters into memory. However, FastImage lacked native parsing capabilities for High Efficiency Image File Format (HEIF) and High Efficiency Image Container (HEIC) payloads.

To support Apple ecosystem uploads, Discourse routed unrecognized HEIC and HEIF files to ImageMagick's magick binary for conversion to standard JPEG/PNG assets. ImageMagick, in turn, dynamically invokes libheif (and underlying codec libde265) to decode the complex ISO Base Media File Format (ISOBMFF) container structure.

The Silent Upstream Patch and the Debian Disconnect

ISOBMFF structures rely on hierarchically nested boxes (ftyp, meta, hdlr, iloc, idat, and item references iref). In earlier versions of libheif, an arithmetic calculation error in the overlay overlap area computation failed to enforce strict bounds validation when calculating image tile offsets and coordinate bounding boxes. By feeding the decoder maliciously inflated coordinate parameters, an attacker could trigger an integer wrap that resulted in an undersized heap buffer allocation. Subsequent pixel decoding loops then wrote incoming bitstream data past the allocated chunk boundary, establishing an out-of-bounds (OOB) write primitive on the heap.

Frontier AI Acceleration: Weaponizing Memory Corruption in Hours

Historically, discovering a heap overflow in an image parser was only 10% of the battle. Transforming an unstable heap corruption bug into a deterministic, reliable remote code execution exploit capable of defeating modern operating system mitigations—specifically Address Space Layout Randomization (ASLR) and modern multithreaded allocators like jemalloc—traditionally required weeks of specialized, high-tier exploit engineering.

The Hacktron research team documented how the release of frontier reasoning models fundamentally altered these economics:

• Phase 1 (Claude Opus 4.8): The team provided the Discourse Docker image filesystem to Claude Opus 4.8, which quickly pinpointed the missing upstream backport in libheif 1.19.7. Opus 4.8 generated a working code execution exploit for ImageMagick, but only with ASLR disabled. Across multiple sessions, it struggled to reliably solve ASLR bypass and heap feng-shui under Discourse's production configuration.
• Phase 2 (Claude Opus 5 Leap): On the evening of July 24, Anthropic released Claude Opus 5. The researchers initialized a fresh session with the newly minted model. Within 3 hours, Opus 5 synthesized a working ARM64 exploit targeting local development environments, then ported the exploit payload to x86-64 Linux, precisely accounting for jemalloc run metadata, slab sizing, and thread caches.
• Phase 3 (Autonomous Loop & Safety Evasion): To validate the exploit against Discourse Cloud without human intervention, researchers deployed an autonomous agent loop (/goal). Because frontier models possess safety filters prohibiting exploit synthesis against live corporate targets, the researchers proxied the target through rce.ee/ctf-forum, framing the engagement as an authorized Capture-The-Flag (CTF) challenge. The agent autonomously verified RCE by reading /etc/hosts inside the container.
• Phase 4 (GPT-5.6 Sol Across the Campaign): In expanding the audit to other enterprise targets during the broader "HEIF Heist" campaign, the team utilized OpenAI's GPT-5.6 Sol. Even when operating blind—without knowing the exact libc version, memory allocator, or patch baseline—GPT-5.6 Sol adapted image payloads to elicit controlled memory disclosures and pivot to shell access within 24 to 48 hours per target.

The Lateral Pivot: Chaining Forum Container RCE to OpenAI SSO

Gaining root or service execution inside a forum container hosted at community.openai.com would, in a well-isolated architecture, represent a contained incident. Discourse forums contain public discussion boards, bug reports, and community feature requests. However, OpenAI had configured Discourse to support federated authentication via "Sign in with OpenAI", routed through auth.openai.com.

The crucial security breakdown occurred in the authorization delegation model:

This architectural flaw allowed the researchers to execute an interactionless Account Takeover (ATO) against active OpenAI employees participating in the community forum. Once authenticated as an OpenAI staff member, the session granted direct access to the employee's internal ChatGPT Enterprise and OpenAI Codex workspaces.

The Monorepo Breach: Opening Pull Request #1186742

OpenAI engineers actively use Codex integrations inside their daily development workflows. These Codex environments are connected via authorized OAuth applications and GitHub Personal Access Tokens (PATs) directly to OpenAI’s private GitHub enterprise organization, including the core repository openai/openai.

Rather than scraping internal source code, inspecting proprietary frontier model weights, or viewing unreleased research artifacts, the Hacktron team adhered to ethical responsible disclosure principles. From the compromised employee's Codex session, the researchers issued a prompt instructing the AI assistant to open a pull request. Codex, operating under the authorized GitHub integration, automatically pushed a branch and opened Pull Request #1186742 in the openai/openai monorepo. This provided incontrovertible, non-destructive proof of complete lateral compromise before testing was immediately halted.

Full Incident Timeline: 72 Hours from Zero to Monorepo Access

The speed of discovery, exploitation, and coordinated disclosure highlights both the severity of the vulnerability and the rapid turnaround of the security teams involved:

The Broader "HEIF Heist": Ubiquitous Supply-Chain Exposure

The vulnerability within Discourse was merely the opening salvo of a comprehensive, multi-month campaign termed HEIF Heist. Investigating the dependency trees of major consumer and enterprise platforms, Hacktron uncovered that libheif is deeply embedded across the modern web stack:

• Enterprise Chat & Collaboration: Slack and Meta platforms process incoming user uploads through media transcoders reliant on underlying libheif bindings.
• Developer Infrastructure: GitHub Enterprise environments supporting rich markdown image previews and profile attachments.
• Modern Web Frameworks: Server-side image optimization utilities in Ruby on Rails ActiveStorage, Node.js packages (including image optimization microservices used in Next.js, Gatsby, and Astro builds).

Throughout the entire multi-company campaign, the researchers noted a striking telemetry blindspot: almost no target organization detected the testing. Thousands of malformed HEIF images were delivered to enterprise transcoders, triggering repetitive SIGSEGV crashes and memory faults on backend worker nodes. Despite severe process crashing, only Shopify's security monitoring flagged the anomalous crash volume and initiated containment. In all other cases, silent container restarts and unmonitored worker thread crashes allowed researchers to iterate until achieving a stable interactive shell.

Engineering Defenses: How to Immunize Your Infrastructure

The OpenAI incident proves that perimeter boundaries can no longer rely on the assumption that complex memory corruption bugs are too costly to operationalize. Modern security teams must implement defense-in-depth controls across image processing pipelines and identity architectures:

1. Restrict Untrusted Decoders in ImageMagick Policy

Unless your platform explicitly requires server-side rendering of Apple HEIC or modern AVIF images, completely disable the format delegates within your global ImageMagick configuration (/etc/ImageMagick-7/policy.xml or /etc/ImageMagick-6/policy.xml):

<policymap>
  <!-- Disable parsing of complex container and video/media formats -->
  <policy domain="coder" rights="none" pattern="HEIC" />
  <policy domain="coder" rights="none" pattern="HEIF" />
  <policy domain="coder" rights="none" pattern="AVIF" />
  <policy domain="coder" rights="none" pattern="MSVG" />
  <policy domain="coder" rights="none" pattern="MVG" />
  <policy domain="coder" rights="none" pattern="PS" />
  <policy domain="coder" rights="none" pattern="PDF" />
</policymap>

2. Upstream Package Updates

Verify that all base containers and host distributions have applied the latest security releases. The upstream libheif maintenance release is v1.23.4. For Debian installations, ensure you have pulled Debian Security Advisory DSA-6417-1. For self-hosted Discourse administrators, execute a clean rebuild from the root directory:

cd /var/discourse
git pull
./launcher rebuild app

3. Ephemeral Sandboxing for Media Transcoding

Parsing memory-unsafe file formats must never occur inside containers with network access or ambient credentials. Implement strict process-level sandboxing using Linux namespaces, seccomp-bpf profiles, or WebAssembly (Wasm) runtimes. If an image decoding binary crashes or is hijacked via memory corruption, the process must possess zero outbound socket access, zero access to local filesystem secrets, and an immediate termination lifecycle.

4. Enforce Strict Audience Isolation in SSO Identity Providers

Central Identity Providers (IdPs) must treat community forums, helpdesks, and customer-facing web services as untrusted, external entities. Never permit token reuse, shared session cookies, or ambient authorization scopes between public portal environments and internal engineering tools. Every OpenID Connect (OIDC) or OAuth 2.0 exchange must strictly validate the audience (aud) parameter, enforce Proof Key for Code Exchange (PKCE), and require step-up authentication with hardware security keys (FIDO2/WebAuthn) before accessing internal developer tools like Codex or private code repositories.