Hacktron Exploits OpenAI GitHub via HEIF Vulnerability

• •Hacktron exploited a zero-day in libheif to access OpenAI's GitHub.
• •The attack involved a malicious HEIF image uploaded to OpenAI's forum.
• •CVE-2026-32882 is rated 8.8 under CVSS and has been patched.

Hacktron researchers exploited a zero-day flaw in libheif to access OpenAI's internal GitHub repository. The attack began with a malicious HEIF image uploaded to OpenAI's Discourse forum, which allowed them to bypass the identity layer and access an employee's Codex account. They subsequently opened a benign pull request in OpenAI's private monorepo to demonstrate their access. The vulnerability, tracked as CVE-2026-32882, was rated 8.8 under CVSS and required low privileges for exploitation. OpenAI fixed the identity flaw within 14 hours of its discovery in July and awarded Hacktron a $6,500 bounty. Security experts have raised concerns about the ethics of Hacktron's approach, as it mirrored actions a malicious actor might take. The incident highlights the need for improved security measures in organizations handling sensitive data.