A heap overflow and SSO misconfiguration to compromise OpenAI internal repos

Sep 18, 2026•Handy-Man•View Original

TL;DR Highlight

Claude exploited a libheif bug and reached OpenAI internal repos within 72 hours

Who Should Read

Backend developer running a service that processes user-uploaded images with ImageMagick or similar libraries

Core Mechanics

An image upload led to OpenAI's repos
- Discourse passed HEIF files to ImageMagick, exposing the libheif parser directly to attacker files.
- The heap overflow gave RCE on community.openai.com.
- An OpenAI SSO flaw let them take over employee ChatGPT/Codex accounts and open PR #1186742 in the internal monorepo.
Missing Debian backports were the root cause
- The vulnerable code was changed upstream the previous year but not labeled a security fix and got no CVE.
- Discourse's Debian 12 image shipped libheif 1.19.7 and Debian 13 shipped 1.19.8.
A new model finished the exploit
- Opus 4.8 only got code execution with ASLR disabled.
- It failed across several sessions with ASLR on.
- After Opus 5 launched, a working ARM64 exploit for a local Mac came within 3 hours.
The agent went remote autonomously
- The model refused to write exploits for remote instances, so they proxied via rce.ee/ctf-forum to look like a CTF target.
- In a /goal loop it got RCE on Discourse Cloud and read /etc/hosts.
It was cheap
- The whole HEIF Heist project took 2 months, 3 researchers, and under $3,000 in tokens.
- Adapting the exploit to each company usually took one or two days.
- The post says only Shopify detected the activity.
The SSO flaw is not Discourse-specific
- The post says any first- or third-party service using OpenAI SSO would give the same access if compromised.
- OpenAI confirmed a fix about 14 hours after the report and paid a $6,500 bounty.

Community Reactions

Discourse moved to a landlock sandbox
- A commenter from the Discourse side says all external binaries, including magick, now run in a ruby-landlock sandbox.
- They are also moving from Magick to Vips.
Opinion: accept only JPEG
- A commenter noted the bug was in overlay bounds checking and HEIF has a much larger attack surface than JPEG.
- They suggested converting iPhone images client-side with wasm.
Disappointment that the SSO flaw was not explained
- Commenters said the key part, the SSO flaw, is not described in the post.
- Others were surprised OpenAI's repos sit on public-internet GitHub.
Many said $6,500 is too low
- Several comments compared it to black-market prices and other bounties.
- Others worried about the model helping with exploit development and CTF training.

How to Apply

Check whether your image path allows HEIF
- Today, check whether your upload parser accepts .heic/.heif/.avif and where ImageMagick is called.
- If not needed, restrict formats via ImageMagick policy.xml.
Upgrade libheif and libde265 to security releases
- As of Sept 14, 2026 the latest upstream libheif security release is v1.23.4.
- Distro packages may carry backports, so check the package security advisory too.
Rebuild self-hosted Discourse now
- Run git pull then ./launcher rebuild app in /var/discourse.
- A web UI update alone may not replace the base image.
Isolate image processing in a sandbox
- Run the image pipeline in hardened, ephemeral sandboxes.
- Set up alerts for repeated image processor crashes.

Try It

copy & run

# Paste into Claude Code or ChatGPT (simplified version of the post's lesson: audit your upload pipeline attack surface)

I run a service that processes user-uploaded images. Below are our image processing code and Dockerfile.
{{image upload handling code}}
{{Dockerfile or package list}}

Please check:
1. Map which libraries (ImageMagick, libheif, etc.) HEIC/HEIF/AVIF files are passed to.
2. Tell me whether we need these formats, and if not, how to block them (include a policy.xml example).
3. Propose concrete changes to isolate image processing in a sandbox (separate container, restricted privileges).

Next: after applying the changes, help me verify uploads still work with {{test images}}.

Terminology

heap buffer overflowA bug where writing more data than allocated overwrites neighboring heap memory. Like stuffing a drawer so full it breaks the next one.

RCERemote Code Execution, a vulnerability that lets an attacker run code on your server remotely. It's like getting a remote keyboard to someone else's machine.

ASLRA defense that randomizes memory addresses on each run. Like moving the treasure every time so the map is useless.

BackportApplying a security fix from a newer version to an older package. Like fitting a new lock onto an old door.

SSOSingle sign-on, one login for many services. It's a master key, so a breach has wide impact.

Related Resources

A heap overflow and SSO misconfiguration to compromise OpenAI internal repos

Sep 18, 2026•Handy-Man•View Original

TL;DR Highlight

Claude exploited a libheif bug and reached OpenAI internal repos within 72 hours

Who Should Read

Backend developer running a service that processes user-uploaded images with ImageMagick or similar libraries

Core Mechanics

An image upload led to OpenAI's repos
- Discourse passed HEIF files to ImageMagick, exposing the libheif parser directly to attacker files.
- The heap overflow gave RCE on community.openai.com.
- An OpenAI SSO flaw let them take over employee ChatGPT/Codex accounts and open PR #1186742 in the internal monorepo.
Missing Debian backports were the root cause
- The vulnerable code was changed upstream the previous year but not labeled a security fix and got no CVE.
- Discourse's Debian 12 image shipped libheif 1.19.7 and Debian 13 shipped 1.19.8.
A new model finished the exploit
- Opus 4.8 only got code execution with ASLR disabled.
- It failed across several sessions with ASLR on.
- After Opus 5 launched, a working ARM64 exploit for a local Mac came within 3 hours.
The agent went remote autonomously
- The model refused to write exploits for remote instances, so they proxied via rce.ee/ctf-forum to look like a CTF target.
- In a /goal loop it got RCE on Discourse Cloud and read /etc/hosts.
It was cheap
- The whole HEIF Heist project took 2 months, 3 researchers, and under $3,000 in tokens.
- Adapting the exploit to each company usually took one or two days.
- The post says only Shopify detected the activity.
The SSO flaw is not Discourse-specific
- The post says any first- or third-party service using OpenAI SSO would give the same access if compromised.
- OpenAI confirmed a fix about 14 hours after the report and paid a $6,500 bounty.

Community Reactions

Discourse moved to a landlock sandbox
- A commenter from the Discourse side says all external binaries, including magick, now run in a ruby-landlock sandbox.
- They are also moving from Magick to Vips.
Opinion: accept only JPEG
- A commenter noted the bug was in overlay bounds checking and HEIF has a much larger attack surface than JPEG.
- They suggested converting iPhone images client-side with wasm.
Disappointment that the SSO flaw was not explained
- Commenters said the key part, the SSO flaw, is not described in the post.
- Others were surprised OpenAI's repos sit on public-internet GitHub.
Many said $6,500 is too low
- Several comments compared it to black-market prices and other bounties.
- Others worried about the model helping with exploit development and CTF training.

How to Apply

Check whether your image path allows HEIF
- Today, check whether your upload parser accepts .heic/.heif/.avif and where ImageMagick is called.
- If not needed, restrict formats via ImageMagick policy.xml.
Upgrade libheif and libde265 to security releases
- As of Sept 14, 2026 the latest upstream libheif security release is v1.23.4.
- Distro packages may carry backports, so check the package security advisory too.
Rebuild self-hosted Discourse now
- Run git pull then ./launcher rebuild app in /var/discourse.
- A web UI update alone may not replace the base image.
Isolate image processing in a sandbox
- Run the image pipeline in hardened, ephemeral sandboxes.
- Set up alerts for repeated image processor crashes.

Try It

copy & run

# Paste into Claude Code or ChatGPT (simplified version of the post's lesson: audit your upload pipeline attack surface)

I run a service that processes user-uploaded images. Below are our image processing code and Dockerfile.
{{image upload handling code}}
{{Dockerfile or package list}}

Please check:
1. Map which libraries (ImageMagick, libheif, etc.) HEIC/HEIF/AVIF files are passed to.
2. Tell me whether we need these formats, and if not, how to block them (include a policy.xml example).
3. Propose concrete changes to isolate image processing in a sandbox (separate container, restricted privileges).

Next: after applying the changes, help me verify uploads still work with {{test images}}.

Terminology

heap buffer overflowA bug where writing more data than allocated overwrites neighboring heap memory. Like stuffing a drawer so full it breaks the next one.

RCERemote Code Execution, a vulnerability that lets an attacker run code on your server remotely. It's like getting a remote keyboard to someone else's machine.

ASLRA defense that randomizes memory addresses on each run. Like moving the treasure every time so the map is useless.

BackportApplying a security fix from a newer version to an older package. Like fitting a new lock onto an old door.

SSOSingle sign-on, one login for many services. It's a master key, so a breach has wide impact.

A heap overflow and SSO misconfiguration to compromise OpenAI internal repos

TL;DR Highlight

Who Should Read

Core Mechanics

Community Reactions

How to Apply

Try It

Terminology

Related Papers

Related Resources

A heap overflow and SSO misconfiguration to compromise OpenAI internal repos

TL;DR Highlight

Who Should Read

Core Mechanics

Community Reactions

How to Apply

Try It

Terminology

Related Papers

Related Resources