In July, Hacktron, a small San Francisco AI-security startup, began probing OpenAI’s community infrastructure under the company’s bug-bounty program. Its researchers found that a specially crafted HEIF or HEIC image uploaded to the community forum could exploit a memory flaw in libheif, a component used in Discourse’s image-processing chain.¹

The vulnerability was not new: libheif’s developers had fixed it months earlier. But because the repair was not formally assigned a CVE identifier, the vulnerable version apparently remained in use. Hacktron’s team initially struggled to turn the flaw into a working exploit with Anthropic’s Claude Opus 4.8. Then Anthropic released Opus 5. “Within hours of Opus 5’s release, we gave it the same problem and it succeeded,” Hacktron wrote.¹

That foothold led to a second weakness. The researchers said they could take over ChatGPT and Codex accounts tied to community-forum sign-ins, including an OpenAI employee’s account. The employee’s Codex was connected to OpenAI’s GitHub organization, though Hacktron says it stopped before viewing internal code or making changes.²

Hacktron alerted OpenAI and Discourse rather than pushing further. Discourse issued a fix on July 27, and OpenAI awarded the researchers $6,500. OpenAI said it had narrowed permissions on Community sign-in tokens and revoked affected tokens and sessions, adding: “We thank the researchers for contacting us and sharing their findings.”²

The two sides agree on the immediate outcome: disclosure worked and the holes were closed. Their broader reading is more sobering. For Hacktron, the episode demonstrates that advanced models can accelerate exploit development; founder Mohan Pedhapati said work that once took months can now take days.¹ For OpenAI, it is also a reminder that AI safety and conventional cybersecurity are now colliding at the same weak points: third-party software, overlooked patches and overly broad access tokens.