The entry point was libheif, an image processing library used by OpenAI’s Discourse forum software. The library’s developers had already fixed the vulnerability, but the patch was not flagged as a security fix and Discourse remained vulnerable. Uploading a HEIF image let the researchers run code on the forum server; the separate login flaw then enabled account takeovers. OpenAI fixed the login issue roughly 14 hours after the report and paid a $6,500 bounty. The company said its review found only “limited reads” of private repository metadata and code changes, with no model weights believed exposed.
The same libheif vulnerability also affected Next.js image optimization. It was reproduced with Hacktron AI and disclosed to the maintainer, and the underlying issue was fixed. Vercel’s hosted image optimization is protected from exploitation by sandboxing the code that processes potentially hostile images. Hacktron’s broader investigation found attack paths affecting Slack, Meta, GitHub Enterprise, Rails and ImageMagick, among others.