Researchers use AI to find widespread software decoder flaw

September 18, 2026 at 10:19 PM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

Hacktron researchers used Anthropic's Claude and OpenAI's Codex to discover a critical vulnerability in the libheif and libde265 image decoding libraries. The flaw, named HEIF Heist, allowed remote code execution and access to internal systems at OpenAI, Meta, GitHub Enterprise, and other platforms. The vulnerability has been patched, but deployments lacking the latest updates remain at risk.

Key Facts

Hacktron researchers used Anthropic's Claude and OpenAI's Codex to discover the HEIF Heist vulnerability in libheif and libde265.
The vulnerability allowed remote code execution and access to internal OpenAI repositories, Meta's core product suite, GitHub Enterprise servers, and Discourse forums.
On July 25, Hacktron AI gained access to OpenAI employee ChatGPT and Codex accounts and a private source code repository, and OpenAI fixed the issue within 14 hours.
The attack chain began by uploading a malicious HEIF image as an avatar on the OpenAI forum, exploiting a buffer overflow in an outdated libheif library on the Discourse platform.
The latest version of libheif has been patched, but any deployment lacking the latest upstream security patches is potentially vulnerable.

Vulnerability Discovery

Hacktron researchers Harsh Jaiswal, Mohan SRK, Rahul Maini, and Sudhanshu Rajbhar led the discovery, assisted by AI systems including Hacktron Harness, GPT-5.6 Sol, and Opus 5. The team used Anthropic's Claude and OpenAI's Codex to identify the flaw in libheif and libde265, libraries used to parse C and C++ software. The vulnerability, named HEIF Heist, triggers memory corruption errors when processing malicious HEIF, HEIC, and AVIF image files. The researchers published their findings in a report on Thursday, detailing potential damage including access to internal OpenAI repositories and leaking user files and access tokens for services like Amazon Web Services.

OpenAI Intrusion

On July 25, Hacktron AI, participating in OpenAI's bug bounty program, penetrated the company's internal infrastructure. The attack began by uploading a malicious HEIF image as an avatar on the OpenAI forum, which ran on the Discourse platform. The forum server processed the image through an outdated libheif library with a buffer overflow vulnerability, enabling arbitrary code execution. After gaining server access, the researchers discovered a single sign-on (SSO) misconfiguration that failed to properly isolate forum sessions from other OpenAI services. By intercepting session tokens, they impersonated a real employee and accessed corporate accounts, including GitHub, Slack, and email, due to OpenAI's unified authentication.

Impact and Mitigation

The vulnerability allowed remote code execution across Meta's core product suite, GitHub Enterprise servers, and the open-source forum Discourse. Even without remote code execution, the attack primitives could allow arbitrary heap disclosure, letting an attacker steal in-memory data such as other users' data and environment variables. OpenAI fixed the reported issue within 14 hours of Hacktron's disclosure. The latest version of libheif has been patched, but deployments lacking the latest upstream security patches remain potentially vulnerable.