Overview
A research project called "HEIF Heist" has demonstrated how quickly frontier AI models can turn a quiet, unflagged open-source bug fix into a working remote-code-execution chain. Hacktron AI, an AI-powered offensive security research outfit, used a combination of Anthropic's Claude and OpenAI's own model family to find and weaponize a memory-corruption flaw in libheif, the C/C++ library that underlies HEIF, HEIC, and AVIF image decoding across a huge swath of modern software. The bug, since patched, gave the researchers remote code execution and access to user accounts and production environments — including Meta's core product suite and an internal OpenAI software repository. The findings were published September 18, 2026, and covered by CyberScoop.
How the Flaw Was Found
Hacktron's four-person research team — Harsh Jaiswal, Mohan SRK, Rahul Maini, and Sudhanshu Rajbhar — didn't hand-write the exploit code themselves. Instead, they leaned on AI models to do the heavy lifting: analyzing the vulnerable decoder path, reasoning about memory layout, and generating working proof-of-concept exploits. Early attempts with an older Claude model stalled against ASLR protections, but once Anthropic's newer Opus 5 became available, the team had working exploits for both an ARM64 test machine and the x86-64 production environment within roughly three hours. Attribution in the published report credits the work as "led" by the human researchers and "assisted by Hacktron Harness, GPT-5.6 Sol, and Opus 5." Across the roughly two-month broader HEIF Heist effort, Hacktron says total AI compute cost stayed under three thousand dollars — a fraction of what equivalent manual research would traditionally require.
The Vulnerability
The entry point was OpenAI's community support forum (community.openai.com), which runs on the open-source Discourse platform and supports single sign-on through OpenAI accounts. While probing the forum's image-upload feature, researchers found that Discourse's default image validator, FastImage, does not understand HEIF or HEIC files — so uploads in those formats get routed instead to ImageMagick, which hands them off to libheif for decoding. The Debian 12 server backing the forum was running libheif 1.19.7, which contained a heap-based memory-corruption bug reachable through a specially crafted HEIF file.
The general class of bug — corrupted memory during decoding of overlay image items in HEIF/AVIF files — is publicly tracked in the libheif project as CVE-2026-32882, a heap out-of-bounds read in overlay compositing that was fixed in libheif 1.22.0. Hacktron's own write-up adds a twist specific to the chain they exploited: the precise code path they turned into working remote code execution had reportedly already been fixed upstream a year earlier, but the fix was logged as a routine "clean-up" commit with no security advisory and no CVE attached — so it never got flagged for backporting into Debian's packaged build. That gap is what left a production system exposed to a bug the maintainers believed was long since closed.
From initial upload to full compromise moved fast: researchers confirmed remote code execution on the Discourse server, then used the SSO link between the forum and OpenAI accounts to escalate into employee ChatGPT and Codex sessions, and from there reached OpenAI's internal GitHub "monorepo." To prove access without doing harm, they submitted a benign pull request from a compromised employee Codex account and stopped. The entire chain, from image upload to repository access, took under 72 hours.
Who Was Affected
OpenAI confirmed the issues, fixed them, and paid Hacktron a six-thousand-five-hundred-dollar bounty through the disclosure process; Discourse separately shipped its own patch for the image-processing exposure. Because libheif is a dependency baked into far more software than just one support forum, Hacktron expanded its research into the broader "HEIF Heist" survey, reporting related decoder exposure in software tied to Meta, Slack, GitHub Enterprise, Ruby on Rails deployments, and Node.js-based frameworks including Next.js, Astro, and Gatsby. Some of those findings carry stronger independent confirmation than others: Vercel published its own advisory acknowledging the Next.js-related issue, and libheif's maintainers confirmed a working code-execution exploit tied to the Meta-linked finding, but the wider claim of confirmed code execution across every listed application has not been independently verified beyond Hacktron's own account.
Why It Matters
HEIF Heist is as much a story about process as it is about a single bug. It shows that AI models can now compress vulnerability research and exploit development that used to take a well-resourced team weeks — from initial analysis to a working exploit against a patched-adjacent, ASLR-protected production target — into a matter of hours or days, at a research cost of a few thousand dollars. It also exposes a quieter, more structural problem: an upstream fix that isn't labeled as security-relevant can sit unpatched in downstream distributions indefinitely, effectively functioning as an unknown vulnerability even after the maintainers believe it's resolved. And because a single widely reused decoding library sits underneath chat platforms, developer tools, and web frameworks that have little else in common, one overlooked memory-safety bug can ripple across an ecosystem far larger than any one vendor. Hacktron's own recommendation is blunt: update to the latest patched libheif and libde265 releases, and treat any pipeline that decodes untrusted images — HEIF, HEIC, or AVIF — as something that belongs in a sandboxed, ephemeral environment rather than directly inside a production application.