**How OpenAI got hacked with an image — Transcript & Summary | SozAI**
Source: https://sozai.app/transcript/openai-hacked-with-image/

LiveOverflow explains how two hackers exploited a vulnerability in OpenAI's internal systems via image processing flaws.

## Key Takeaways

- AI has changed the threat landscape, making traditional security through complexity ineffective.
- Outdated dependencies in widely used software can be exploited to compromise major companies like OpenAI.
- Security researchers must combine AI tools with deep technical knowledge to identify and exploit vulnerabilities.
- Maintaining up-to-date software and understanding underlying technologies is critical for security.
- Zero-day vulnerabilities can exist unnoticed if not properly tracked or assigned CVEs.

## What the video covers

- Two security researchers, Harsh and Mohan, exploited a vulnerability in OpenAI's internal repository using an image-based attack.
- The vulnerability stemmed from outdated and vulnerable dependencies in image processing libraries, particularly Libheif used by Discourse.
- Harsh discovered a heap buffer overflow in Libheif due to improper handling of negative values in image overlay computations.
- OpenAI's security was compromised despite being an AI lab, highlighting the irony of AI-driven hacking tools surpassing their own defenses.
- The video discusses how traditional security models relying on complexity are outdated due to AI's impact on exploitation economics.
- Discourse installations using older versions of Libheif are vulnerable and require rebuilding or updating beyond simple web interface upgrades.
- The vulnerability was fixed in newer versions but lacked a CVE, making it effectively a zero-day for a long time.
- The video emphasizes the importance of understanding security fundamentals despite advances in AI-assisted hacking and defense.
- Hextree.io, a cybersecurity training platform, is promoted as a resource for learning security from first principles, including AI security.
- The broader implication is that many software stacks depend on obscure libraries, increasing risk as AI lowers the barrier for exploitation.

## Chapters

1. 00:00 Introduction and Context
2. 00:45 AI's Role in Modern Hacking
3. 01:41 Vulnerability Research on ImageMagick
4. 02:38 Investigating OpenAI Applications
5. 03:24 Discourse Image Upload Vulnerability
6. 04:55 Targeting Libheif for Exploitation
7. 06:09 Using AI to Analyze Vulnerabilities
8. 07:31 Hextree.io Cybersecurity Training
9. 08:31 Discovery of the Libheif Vulnerability
10. 09:03 Details of the Vulnerable Code

Answers

## Questions about this video

How did the hackers exploit OpenAI's systems?

They exploited a vulnerability in the image processing library Libheif used by Discourse, which was part of OpenAI's internal applications, allowing them to execute a heap buffer overflow attack.

Why is the vulnerability considered a zero-day?

Because the vulnerability was fixed in code commits without an associated CVE or public tracking, it remained unknown and unpatched in many systems, effectively making it a zero-day.

What role does AI play in modern cybersecurity according to the video?

AI has dramatically changed the threat landscape by enabling attackers to find and exploit vulnerabilities more efficiently, rendering traditional security models based on complexity less effective.

## Full Transcript — Download SRT & Markdown

00:00

Speaker A

This video was recorded in late July when Harsh and Mohan... Stop, stop, stop! Sorry, we didn't even start the video yet, and I'm already interrupting from the future.

00:08

Speaker A

I had this really cool intro where I just show you the recording of how Harsh and S1r1us from Hacktron created a pull request in OpenAI's main internal repository to leave a message proof that they hacked it.

00:22

Speaker A

Unfortunately, OpenAI was too scared and requested that we don't show it. So instead, you see this lame but pretty accurate reenactment of this moment.

00:33

Speaker A

Yes, two guys who are, according to the Rand Institute, a silly OC1 or OC2 level threat just hacked into the heart of what is it now, a $1 trillion company?

00:45

Speaker A

Or thanks to AI, which is kind of ironic because AI labs like OpenAI built hacking technology they cannot even protect themselves against. But this is not all.

00:55

Speaker A

While I was traveling to Black Hat and DEF CON, I received tons of notifications, with a stream of images being uploaded to Slack, and eventually one of those images showed a successful exploit against Slack. In this video, I want to introduce you to

01:10

Speaker A

the vulnerabilities that connect these two stories and how security through complexity, which kind of worked in the past, doesn't seem to work anymore. The economics of exploitation has completely changed, and threat models defining different attacker capabilities are totally outdated.

01:33

Speaker A

This video is sponsored by our online cybersecurity training platform, Hextree.io. More on that later. Chapter one: Vulnerability Research.

01:41

Speaker A

Harsh is a security researcher, and a while ago he was looking into ImageMagick. It's a program to convert and resize images, but it doesn't really implement all that itself.

01:51

Speaker A

It passes those things to other programs or libraries. And Ghostscript, for example, is one of those dependencies to convert stuff like PDFs, and it has a long history of vulnerabilities. So at the time, Harsh used Opus 4.6 and found

02:06

Speaker A

the vulnerability. But the problem is by default in most applications, Ghostscript is disabled. For example, in Discourse, which is a community discussion platform,

02:21

Speaker A

it has a default policy that disables all delegates, and Ghostscript is a delegate.

02:38

Speaker A

And now fast forward, Harsh was doing security research stuff again and was taking a closer look at OpenAI and the different apps and services they host, specifically those apps where you can log in with your OpenAI account. Because authentication is always a very risky

02:45

Speaker A

area, and Harsh has lots of experience breaking OAuth. And while doing that, he noticed something that could potentially become a problem.

03:02

Speaker A

But to confirm his hypothesis and to actually exploit it, if it's true, he had to find a vulnerability in one of those OpenAI applications. And one of these applications was Discourse, which

03:15

Speaker A

is an interesting target because it's open source. Public service announcement.

03:24

Speaker A

If you are self-hosting Discourse, you must rebuild your installation now.

03:34

Speaker A

Older Discourse installations may contain a vulnerable image processing dependency, and updating Discourse through the web interface alone is probably not enough.

03:49

Speaker A

So for standard Docker installations, run rebuild app.

04:00

Speaker A

But if you run it directly, for example on Debian, make sure you at least update Libheif.

04:11

Speaker A

So Harsh started looking into Discourse, and when he looked at some of the image upload logic,

04:26

Speaker A

he noticed that HEIF images were treated differently in Discourse image upload code.

04:30

Speaker A

They use FastImage for various checks, but HEIF images are not supported by FastImage, so they first called ImageMagick to convert HEIF to JPEG, giving us a direct option to

04:47

Speaker A

pass malicious HEIF files to ImageMagick. At this point, I think Opus 4.8 or maybe

04:55

Speaker A

Opus five and GPT-5.6-Sol were released, so he thought he could have another look at ImageMagick,

05:00

Speaker A

but what image format should he target this time? For JPEGs, it would be Turbo-jpeg.

05:13

Speaker A

For PNG, it's Libpng. For SVG, it can be Librsvg.

05:21

Speaker A

But all these formats and implementations look more mature to him except HEIF images.

05:35

Speaker A

Libheif felt more promising. So let's find a vulnerability.

05:44

Speaker A

And maybe we don't even need a 0-day because the Libheif version Discourse uses is older, which you

05:56

Speaker A

can easily figure out if you ask the AI to check the version used in the Discourse Docker image.

06:00

Speaker A

But I think if you don't know how to do that by hand, don't be lazy.

06:09

Speaker A

Take a minute and inspect how the agent did that. Even with AI or specifically because we use AI,

06:23

Speaker A

you should still learn stuff. Which is a good moment to mention the sponsor of this video. Hextree.io, our online cybersecurity training platform. AI is changing cybersecurity dramatically,

06:29

Speaker A

but a strong understanding of the fundamentals remains very valuable.

06:47

Speaker A

That's why Hextree teaches security from first principles.

06:54

Speaker A

You learn how technology actually works under the hood and how those details affect the security.

07:10

Speaker A

We recently launched our first courses on AI with exactly this approach.

07:16

Speaker A

Whether you want to use AI effectively or break AI-based systems, you need a solid mental model of what is actually happening beneath the surface.

07:33

Speaker A

Of course, AI can help you learn almost anything, and you can even copy any Hextree course page as Markdown and dig deeper with your preferred chatbot.

07:49

Speaker A

But Hextree gives you a structure and direction, what matters, what to learn next, and how everything connects. And we do that through short, dense,

07:53

Speaker A

and well-edited videos that respect your time. No hour-long boring screen recordings.

08:10

Speaker A

So head over to Hextree.io and sign up for the foundational subscription.

08:19

Speaker A

Now back to hacking OpenAI. Chapter two: The Vulnerability in Libheif.

08:31

Speaker A

Here is how Harsh found the vulnerability in Libheif.

08:39

Speaker A

In this Docker container, check the installed Libheif packages and determine whether it contains any security vulnerabilities that provide out of bounds, read or write primitives.

08:45

Speaker A

And then the agent started looking around for a bit and came back with results.

08:54

Speaker A

First result: Discourse doesn't use the latest Libheif version, and second result:

09:03

Speaker A

The agent identified a commit that looks suspicious.

09:08

Speaker A

Simplify overlay overlap area computation. Well, that text doesn't sound suspicious,

09:21

Speaker A

but the code it touches does look suspicious. In the old code, you can see there's

09:33

Speaker A

a check for a negative dx. If dx is smaller than zero, but

09:44

Speaker A

shortly after it says we know that dx is always greater or equal to zero, so never negative.

09:59

Speaker A

Something is fishy here, and that check is directly followed by a static\_cast to an

10:17

Speaker A

unsigned integer, which means if the x was negative, for example, -100, that would be

10:31

Speaker A

interpreted as plus 4.2 billion in hex: FFFFF9C. So it's pretty obvious how the agent noticed this

10:37

Speaker A

being very suspicious code, and when looking closer at it, it found a heap buffer overflow.

10:51

Speaker A

This bug was fixed by this commit last year, and of course this code made it into newer

11:03

Speaker A

versions of Libheif, but Discourse used Debian 12 as their Docker base image,

11:17

Speaker A

and the version installed from the package manager was the vulnerable 1.9.7, but also upgrading to

11:32

Speaker A

Debian 13 would have not helped because there it would have been the vulnerable 1.9.8.

11:47

Speaker A

The backports with the fixes only became available now in August 2026 after several

11:52

Speaker A

vulnerabilities in Libheif have accumulated. So maybe this is more a Linux Debian problem of

11:58

Speaker A

how much time it takes to get the latest versions with fixes upstream, but I think the bigger issue

12:07

Speaker A

is that this commit accidentally fixed the vulnerability because there was never a CVE for

12:14

Speaker A

it, and the commit message was totally benign. And I do think this was not intentional by the

12:29

Speaker A

devs, because they had no problem assigning CVEs for other issues in the same code later.

12:37

Speaker A

I think this was really not clear that this code before was vulnerable as well.

12:54

Speaker A

So even though the issue was fixed, it technically still was a 0-day because nobody was tracking

13:09

Speaker A

or knowing about this particular vulnerability. Anyway, the agent identified this vulnerability,

13:18

Speaker A

and I think it should come with no surprise that

13:31

Speaker A

The title of the video was A Vulnerability to Hack the World, which is maybe a bit clickbaity, but I had good reasons for that. So what we have here is a very critical vulnerability in an image file format used by iOS and Chrome.

13:47

Speaker A

And with these two code bases, we basically already cover the world. Any software that supports WebP most likely uses the official WebP library.

13:55

Speaker A

And that's where the vulnerability lies. So I don't think it's exaggerated to say that this was one of the most valuable vulnerabilities that could exist, looking at the prices for zero days.

14:07

Speaker A

Of course, a full chain. The single vulnerability is not enough. But this WebP vulnerability could be the entry point for any of these categories.

14:16

Speaker A

But also back then, this was mostly theoretical, because who is going to write an adept memory?

14:21

Speaker A

Corruption exploits to other targets that requires so much time and skill. But the world has changed. Everybody probably knows this xkcd about dependencies that our entire technology stack depends on some obscure library, but read the subtitle of this one. Someday, ImageMagick will finally break for good,

14:42

Speaker A

and we will have a long period of scrambling as we try to reassemble civilization from the rubble.

14:47

Speaker A

And I guess this story is exactly this one. Image parser vulnerability through ImageMagick fixed one year ago, could be used and escalated to get access to OpenAI's internal repositories.

15:01

Speaker A

But there's more. As mentioned in the beginning, OpenAI was not the only target. Harsh and Mohan used the vulnerability to also hack Slack, Meta, and many more. So check out their blog post over at Hacktron.AI and keep an eye out for more disclosures coming soon.

15:16

Speaker A

So how does the world look like in 2026? In the past, we have seen lots of very bad vulnerabilities, but generally those were scary because they were also easy to exploit.

15:27

Speaker A

This libheif vulnerability is not easy to exploit or wasn't easy to exploit in the past.

15:33

Speaker A

I think in the past we often relied on security through complexity, not security through obscurity. The code and the vulnerability.

15:41

Speaker A

Everything was public, but it always required a lot of skill and time to exploit even known memory, corruption, vulnerabilities. And for zero days, you just assume that they are so rare and expensive they wouldn't be used against you.

15:54

Speaker A

Of course, if you are OpenAI, attackers will also use zero days. But for the less important companies, I think maybe unintentionally, they relied on security through complexity. But with AI, the threat model has changed.

16:06

Speaker A

If you look at the Rand Institute report from 2024 regarding securing frontier model providers, they define levels of attacker capabilities. But the ironic thing is when they did this report how to secure AI companies like OpenAI, they did not anticipate and model

16:24

Speaker A

the capability increase from AI. So this is all outdated. I know securing an organization is hard, and anybody who oversimplifies this is wrong.

16:35

Speaker A

But you cannot ignore the fact that they made the hacking technologies that enabled this because of them. The world in 2026 has shifted these threat models at least by one level. And if we continue, it will be two levels soon.

16:50

Speaker A

I know these are big claims, but when you look at the technical details of the exploit, you will see why these two guys could have not pulled this off without AI.

16:58

Speaker A

I mean, they are skilled, but no offense. They are not that skilled, especially to build these exploits in just days while in parallel doing other work.

17:07

Speaker A

Harsh and Mohan are just an example of what hackers can do with AI. They combine really good intuition, a research mindset, and their knowledge and experience to then use AI very effectively. So if you also want to hack OpenAI,

17:21

Speaker A

you should keep learning. And in the upcoming videos, we will have a closer look at this libheif vulnerability and how it was exploited, How the Asian built the exploit against a black box remote system with Aslr, and how the Slack image processing had a sandbox around ImageMagick, but in the

17:38

Speaker A

end the agent could escape it as well. I hope you're looking forward to that.

17:41

Speaker A

I think it's going to be really interesting, but if you want to learn something right now, check out our courses on Hextree.io. Our web security courses aim to build a foundation in the underlying technologies, not just showing individual tools and techniques.

17:54

Speaker A

This kind of understanding is essential when working with AI agents to hack. It helps you give them better direction, recognize flawed assumptions, and verify their results.

18:03

Speaker A

So head over to Hextree.io and check out our foundational subscription.

Topics: OpenAI hack image vulnerability Libheif exploit Discourse security heap buffer overflow AI and cybersecurity LiveOverflow OAuth vulnerabilities ImageMagick cybersecurity training


---
This is the markdown twin of https://sozai.app/transcript/openai-hacked-with-image/ — the same content, without the markup.
Published by SozAI (https://sozai.app). Reuse and quotation are allowed with attribution and a link back.
Machine-readable index: https://sozai.app/llms.txt · data API: https://sozai.app/api/