Researchers utilized Anthropic’s Claude Opus 5 to exploit an image-decoder vulnerability, compromising OpenAI’s community forum, taking over employees’ ChatGPT and Codex accounts, and gaining access to an internal source-code repository This article explores image decoder vulnerability. . The July 25, 2026 operation by Hacktron linked remote code execution in Discourse’s image-processing stack to a flaw in OpenAI’s single sign-on, demonstrating how a breach in a peripheral service can cross identity boundaries into high-value AI development environments.
Hacktron researchers Harsh Jaiswal, Mohan Pedhapati, and Rahul Maini examined the upload pipeline and discovered that HEIC and HEIF images bypassed FastImage checks due to the library’s lack of support for those formats.
According to Hacktron, the installed Debian package lacked an upstream security fix, leaving a heap-buffer overflow that exposed out-of-bounds read-and-write primitives during HEIC decoding. Debian later released DSA-6417-1, warning that CVE-2026-32882 and related libheif issues could lead to denial of service, memory disclosure, or potentially execute arbitrary code when malformed images were processed. The potential blast radius extended beyond the forum when the researchers instructed an affected employee’s Codex account, connected to OpenAI’s GitHub organization, to open a harmless pull request in the private openai/openai monorepo.
Organizations handling untrusted HEIF, HEIC, or AVIF files should install and update libheif and libde265 packages, disable unnecessary decoders, and run conversions inside hardened, ephemeral sandboxes.
