Three researchers at security startup Hacktron AI chained an image upload vulnerability with an OpenAI login flaw to take over employees’ ChatGPT and Codex accounts in less than 72 hours. The team used Anthropic’s Claude to develop the exploit and demonstrated access on July 25 by submitting a harmless proposed code change to OpenAI’s private GitHub repository.

The entry point was libheif, an image processing library used by OpenAI’s Discourse forum software. The library’s developers had already fixed the vulnerability, but the patch was not flagged as a security fix and Discourse remained vulnerable. Uploading a HEIF image let the researchers run code on the forum server; the separate login flaw then enabled account takeovers. OpenAI fixed the login issue roughly 14 hours after the report and paid a $6,500 bounty. The company said its review found only “limited reads” of private repository metadata and code changes, with no model weights believed exposed.

The same libheif vulnerability also affected Next.js image optimization. It was reproduced with Hacktron AI and disclosed to the maintainer, and the underlying issue was fixed. Vercel’s hosted image optimization is protected from exploitation by sandboxing the code that processes potentially hostile images. Hacktron’s broader investigation found attack paths affecting Slack, Meta, GitHub Enterprise, Rails and ImageMagick, among others.