OpenAI briefly lost control of employee ChatGPT and Codex logins because of a bug in an image library nobody thinks about.
Security firm Hacktron AI, a three-person team, found that OpenAI's community forum runs on Discourse, which hands unsupported image formats like HEIF to ImageMagick's convert tool, which in turn calls a decoder called libheif. Hacktron says it chained a known heap overflow in that decoder with a separate single sign-on misconfiguration at OpenAI, letting a forum account reach into employee ChatGPT and Codex logins. The team says it used that access to make one harmless proof-of-concept pull request on OpenAI's internal GitHub, then reported the whole chain. According to Hacktron's writeup, OpenAI patched the SSO flaw within 14 hours and paid a $6,500 bounty, while Discourse rated the underlying image bug 8.8 on the CVSS scale and added sandboxing around image processing.
The same libheif and libde265 decoders ship through ImageMagick, libvips, Sharp, and standard distro packages, and Hacktron says it traced them into Slack, Meta, GitHub Enterprise, and JS frameworks like Next.js and Astro. That is exposure well beyond one AI company's help forum. It is also a case study in compressed bug-hunting: Hacktron says it spent under $3,000 in Claude tokens over two months, after talking Anthropic's model into helping by framing the target as a capture-the-flag exercise.
The 2020 XKCD comic about one thanklessly maintained open-source component holding up "all modern digital infrastructure" happened to name-check ImageMagick specifically. Hacktron was quick to point out the coincidence, and it is a fair reminder that the boring dependencies are usually the ones worth auditing.