Three researchers operating under the name HacktronAI demonstrated how quickly an AI-assisted team can compromise a high-profile target by chaining overlooked flaws in open-source components. The operation targeted OpenAI's official Discourse-based community forum and resulted in remote code execution, followed by the takeover of employee accounts connected to internal services.
The attack chain started with a single uploaded HEIC image. Discourse relied on FastImage for format detection; when it failed on HEIF files it passed processing to ImageMagick, which in turn used the vulnerable libheif library. A heap buffer overflow present in older versions of libheif had been fixed upstream more than a year earlier, yet the patch carried no CVE identifier and had not reached the Debian 12 packages used in Discourse's Docker images.
Once code execution was obtained on the forum server, the team exploited a weakness in OpenAI's SSO implementation at auth.openai.com. This allowed them to impersonate any user who had previously logged into the forum, including OpenAI staff. Several compromised accounts had access to Outlook, Gmail, Slack, and GitHub. Using one such account, the researchers submitted a harmless pull request to the internal openai/openai repository to prove control.
AI's role in rapid exploit development
The researchers fed Claude Opus 4.8 the Discourse Docker image and quickly identified the missing libheif fix. Initial exploits were unstable under ASLR. After Anthropic released Claude Opus 5, the model produced a working ARM64 exploit within three hours and then ported it to the x86-64 environment with jemalloc. The team placed the model in an autonomous loop that successfully compromised their own Discourse Cloud test instance, bypassing safety filters by framing the target as a CTF machine.
The entire research project, named HEIF Heist, cost less than 3000 dollars in tokens and took roughly two months. The same methodology was later applied to other platforms including Slack, Meta, and GitHub Enterprise, with each new target typically requiring only one or two additional days of adaptation.
Response and lessons
OpenAI fixed the SSO issue within 14 hours of receiving the report. Discourse replied the day after disclosure and prepared a patch the following Monday. On 28 July the project published advisory GHSA-vhm9-85gw-x335 confirming the libheif vector. OpenAI later awarded a 6500-dollar bounty for the SSO findings.
The case illustrates how the absence of CVE numbers for upstream fixes can leave production systems exposed for extended periods, and how AI tooling is lowering the barrier for sophisticated exploit development from months of expert work to days of guided automation.
