A Bug Bounty Reached OpenAI's Own Code
Between July 23 and 25, a small team of bug bounty researchers, working under the name Hacktron, chained two ordinary security flaws into access to OpenAI's internal source code. The first was a heap buffer overflow in libheif, an open-source image library, a bug that had already been quietly fixed upstream the previous year but never assigned a CVE, so most people running it never knew to patch it. The second was a single sign-on misconfiguration on OpenAI's own community help forum. Uploading a crafted HEIF image through that forum's Discourse software triggered the overflow and gave the researchers remote code execution on the forum's server by the morning of July 25.
From there, the SSO misconfiguration let them take over the ChatGPT and Codex accounts of employees who used the same login across OpenAI's community site and its internal tools. One of those employees had their Codex account connected to OpenAI's GitHub organization. Using that connection, the researchers opened a proof-of-concept pull request, numbered 1186742, inside OpenAI's own internal code repository. OpenAI confirmed the issue was fixed the same night, and paid a bounty of 6,500 dollars through its program on September 1.
One Bug, Several Companies
OpenAI was not the only target. The same libheif flaw, chased under a project the researchers call HEIF Heist, gave the team footholds at several other companies that also run image-processing pipelines built on the same library.
| Target | What the researchers reached | Outcome |
|---|---|---|
| OpenAI | Employee account, then a PR inside the internal monorepo | 6,500 dollar bounty, fixed within a day |
| Slack | Image-processing pipeline built on libheif | Reported through Slack's bounty program |
| Meta | Image-processing pipeline built on libheif | Reported through Meta's bounty program |
| GitHub Enterprise | Image-processing pipeline built on libheif | Reported through GitHub's bounty program |
The researchers say the entire two-month HEIF Heist project, across all four companies, cost them under 3,000 dollars in AI model usage. That is the real headline figure: a single silently-patched, CVE-less bug in a shared open-source library was cheap enough for a three-person team to turn into paid findings across four of the best-defended companies in the industry, using an AI model to do the bulk of the triage and exploit-chaining work.
The Model Was Not the Weak Point
It is tempting to read this as a story about an AI model breaking into things on its own. It is not. Claude Opus 4.8 was the researchers' tool for finding the overflow, building a working exploit, and chaining it to the SSO flaw faster and cheaper than a human team could alone. The actual weak points were unglamorous and familiar: an old library bug that never got a CVE and so never got patched everywhere it was used, a single sign-on setup that let one login open several unrelated systems, and an employee's coding-assistant account that carried write access to a company's most sensitive repository.
None of that required beating OpenAI's own AI defenses, because none of it touched OpenAI's AI systems at all. The community help forum, a Discourse install running on outdated image-handling code, was the door. The employee's own account, and everything that account happened to be connected to, was the hallway that led from that door to the monorepo.
What a European Company Should Actually Check
Every one of the four companies hit in this project runs a serious vendor security program, and every one of them still had the same exposure: an internal system reachable through an account whose AI-coding-assistant integration had more reach than anyone had mapped. A typical vendor risk assessment scores the SaaS tools a company buys directly. It rarely asks what a developer's Codex, Claude Code, or Copilot account is connected to on the other side, or what happens if that one login is taken over somewhere unrelated to the company's own systems.
That gap matters under NIS2 and the Cyber Resilience Act, where the disclosure clock starts when an incident is discovered, not when it happens. In this case, discovery came from outside researchers running a bounty program, not from any internal monitoring. A company that cannot answer, today, which of its developers' AI-assistant accounts are connected to which other platforms has no realistic way to know if the same chain has already reached it.
Read next: Cloudflare Finds Bugs With AI, Leaves Patching to You | Anthropic Lets You Host Its Mandatory Logs Yourself
