---
id: "nr-hacktron-chains-libheif-and-sso-flaws-to-access-openai-c72d5a"
slug: "hacktron-chains-libheif-and-sso-flaws-to-access-openai-c72d5a"
title: "Hacktron chains libheif and SSO flaws to access OpenAI employee accounts"
observed_at: "2026-09-18T13:40:45.45798+00:00"
record_date: "2026-09-18"
date_kind: "observed_at"
novelty: "new"
source_platform: "hacktron.ai"
topics: ["security","ai-assisted-security"]
entities: ["Hacktron","OpenAI","libheif"]
related_patterns: []
source_url: "https://hacktron.ai/blog/hacking-openai"
source_urls: ["https://hacktron.ai/blog/hacking-openai"]
basket: {"id":"0325e6b8-f527-4f9b-bfa3-3f30e57f380b","revision":1,"cluster_id":"c72d5a3a-459f-4b62-b452-8c0ad1c5d8a5"}
type: "raw_signal"
description: "Hacktron described chaining a libheif heap overflow on OpenAI's Discourse forum with an SSO flaw to take over OpenAI employee ChatGPT accounts, using Claude models."
why_it_matters: "The root cause is a supply-chain gap: an upstream fix was not labelled as security-relevant, so Debian 12 images shipped vulnerable libheif 1.19.7. Services processing user-supplied HEIC or HEIF images should check libheif. The excerpt does not detail the SSO flaw itself."
verification_level: "source-inspected"
signal_type: "newsroom_basket_signal"
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "signal:hacktron-chains-libheif-and-sso-flaws-to-access-openai-c72d5a"
retrieval_nugget: "Hacktron described chaining a libheif heap overflow on OpenAI's Discourse forum with an SSO flaw to take over OpenAI employee ChatGPT accounts, using Claude models. Hacktron reported that on July 25, 2026 it chained two critical vulnerabilities to take over multiple OpenAI employees' ChatGPT accounts and open a proof-of-concept pull request in an internal OpenAI repository. The chain began with"
status: "published"
visuals: []
routes: {"html":"https://newruntime.com/signals/hacktron-chains-libheif-and-sso-flaws-to-access-openai-c72d5a/","markdown":"https://newruntime.com/signals/hacktron-chains-libheif-and-sso-flaws-to-access-openai-c72d5a.md","json":"https://newruntime.com/signals/hacktron-chains-libheif-and-sso-flaws-to-access-openai-c72d5a.json"}
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
---

# Hacktron chains libheif and SSO flaws to access OpenAI employee accounts

## Retrieval answer

Hacktron described chaining a libheif heap overflow on OpenAI's Discourse forum with an SSO flaw to take over OpenAI employee ChatGPT accounts, using Claude models. Hacktron reported that on July 25, 2026 it chained two critical vulnerabilities to take over multiple OpenAI employees' ChatGPT accounts and open a proof-of-concept pull request in an internal OpenAI repository. The chain began with

Hacktron reported that on July 25, 2026 it chained two critical vulnerabilities to take over multiple OpenAI employees' ChatGPT accounts and open a proof-of-concept pull request in an internal OpenAI repository. The chain began with a libheif heap buffer overflow in OpenAI's Discourse forum, found and exploited using Claude Opus 4.8 and Opus 5. OpenAI fixed its side within about 14 hours and paid a $6,500 bounty.

The root cause is a supply-chain gap: an upstream fix was not labelled as security-relevant, so Debian 12 images shipped vulnerable libheif 1.19.7. Services processing user-supplied HEIC or HEIF images should check libheif. The excerpt does not detail the SSO flaw itself.

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Security](https://newruntime.com/topics/security.md): Explore the security topic hub.
- topic hub: [Ai Assisted Security](https://newruntime.com/topics/ai-assisted-security.md): Explore the ai-assisted-security topic hub.
- collection: [Raw Signals](https://newruntime.com/signals.json): Open every source-linked raw signal.
- collection: [Source Ledger](https://newruntime.com/source-ledger.json): Inspect the public source evidence graph.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)