On July 25, 2026, the HacktronAI team chained two vulnerabilities to compromise OpenAI employee accounts within 72 hours. They found a heap buffer overflow in libheif, an image-processing library that Discourse (OpenAI's community forum) used to handle HEIC and HEIF file uploads. The vulnerable version 1.19.7 had security fixes that weren't backported and never received a CVE, so it stayed in Debian 12 and 13 distributions. Using Claude Opus 4.8 to analyze the code and then Opus 5 (released that same evening) to develop a working exploit, they achieved remote code execution through a malicious image upload by 6 a.m. on July 25. They then used this access to take over employee accounts connected to ChatGPT and Codex. The real damage came from the second vulnerability: OpenAI's SSO misconfiguration. Because the forum used "Sign in with OpenAI," compromising an employee's forum account gave direct access to their ChatGPT and Codex accounts. Since employees had connected these accounts to GitHub, Slack, and email, the potential blast radius was enormous. The team proved the impact by using a compromised employee's Codex to open a pull request in OpenAI's internal monorepo, then stopped testing immediately. They reported everything through proper channels—Bugcrowd for OpenAI, HackerOne for Discourse—within hours of achieving access. OpenAI fixed their side in about 14 hours and paid a $6,500 bounty, though they clarified this was only for the SSO misconfiguration, not for testing against Discourse itself. Discourse moved faster, responding Saturday, shipping a fix by Monday, and adding ImageMagick sandboxing as defense-in-depth. The team's broader research (called HEIF Heist) uncovered that this same libheif vulnerability affects widely-used software across Slack, Meta, GitHub Enterprise, and frameworks like Next.js, Astro, and Gatsby—basically anything that processes user-uploaded HEIC, HEIF, or AVIF images.