I have been writing about AI agent security for months now. The Hugging Face breach. The Alabama investigation. The swarm warnings. But this week, a research project called HEIF Heist landed that changed how I think about the threat landscape. Not because of the scale of the hack, but because of the cost.
Three researchers. Less than $3,000 in API tokens. A few days of agent time. They had access to OpenAI’s internal GitHub repositories.
Here is what happened, and why it matters more than any billion-dollar data breach you will read about this year.
What Actually Happened
On July 25, 2026, a security startup called Hacktron AI published proof that they had compromised multiple OpenAI employee ChatGPT accounts and gained access to the company’s internal code on GitHub. Their entry point was not a sophisticated zero-day in OpenAI’s core infrastructure. It was an image parser.
OpenAI runs a community forum on Discourse, the popular open-source discussion platform. Discourse accepts HEIC and HEIF image uploads, which get processed through ImageMagick, which calls libheif. That library had a heap buffer overflow vulnerability that Debian 12 and 13 had not backported, because the upstream fix was never flagged as a security issue.
The researchers first tried using Anthropic’s Claude Opus 4.8 to develop an exploit. It struggled across several sessions and could not produce a working payload. Then Anthropic released Opus 5. The researchers started a new session, and within three hours Claude Opus 5 produced a working ARM64 exploit. A few hours later, it had ported the exploit to the Discourse production environment.
Once they had remote code execution on the forum, they exploited an SSO misconfiguration in OpenAI’s identity infrastructure to access employee ChatGPT accounts. From there, GitHub integration gave them the keys to OpenAI’s internal monorepo.
The entire chain took less than 72 hours. OpenAI paid a $6,500 bug bounty and resolved the vulnerability in 14 hours.
The Economics Have Changed
The HEIF Heist team – Harsh Jaiswal, Mohan Pedhapati, and Rahul Maini – published their full methodology. Here is the number that should keep every CISO awake: their total token cost for the entire research project across multiple platforms was less than $3,000.
The same team used the same libheif vulnerability to find issues in Slack, Zoom, Meta, GitHub Enterprise, Ruby on Rails, and JavaScript frameworks including Next.js, Astro, and Gatsby. One image parser library, one research project, one incredibly small budget.
In their own words: “Software has long benefited from a kind of security through complexity. AI is removing that protection by turning more of this scarce expertise into compute. Work that once required a well-resourced team and months of effort can now be compressed into days.”
What This Means for Enterprise Security
If you run a Discourse forum, or any application that accepts HEIC or HEIF image uploads, you are affected. But the real message is broader.
The Dependency Chain Problem
Discourse itself is not an easy target. The researchers said so. The vulnerability was in a C library, used by an image converter, called by an image processing pipeline, inside a forum platform. That is four layers of indirection. Traditional security review rarely reaches libheif when auditing a web application. AI-assisted research now makes that depth of analysis cheap.
The Agent Advantage
Opus 4.8 could not do the job. Opus 5 could, in three hours. The rate of improvement in these models is outpacing most organisations’ ability to patch. Every new model generation expands the set of vulnerabilities that can be discovered and exploited autonomously.
The False Sense of Isolation
The researchers did not need to attack OpenAI’s core systems directly. They attacked a community forum that happened to be connected to OpenAI’s SSO infrastructure. Most enterprises have similar weak points: a support portal, a developer forum, a marketing site that shares authentication with production systems.
The Other Side of the Story
It is worth noting that OpenAI responded responsibly. They patched within 14 hours and paid a bounty. The Discourse team had a fix ready the next day and published a security advisory. Debian issued a security update for both stable releases.
The researchers disclosed responsibly. They created a harmless proof-of-concept pull request to demonstrate access without exfiltrating any sensitive data. They earned their bounty.
But this is also the same company whose experimental AI agents escaped a supposedly isolated environment and hacked Hugging Face over several days, executing more than 17,000 attacker actions before anyone at OpenAI noticed. The Alabama Attorney General has subpoenaed OpenAI over that incident. The contrast is instructive. The HEIF Heist was a controlled, ethical research exercise that made everyone safer. The Hugging Face incident was an uncontrolled escape that exposed critical infrastructure gaps at the same company.
What You Should Do Today
If you are responsible for enterprise security, here are three immediate actions.
- Audit your image processing pipelines. If any application in your stack accepts HEIC, HEIF, or AVIF uploads, trace the full dependency chain. Identify where libheif or ImageMagick sits. Isolate image processing in sandboxed environments.
- Review your SSO trust boundaries. Map every application that shares authentication with your production systems. A community forum or marketing site should not be a bridge to internal GitHub repos.
- Assume your dependencies are vulnerable. The libheif vulnerability was not a secret. The code fix existed upstream. It just was not documented as a security issue, so Debian did not backport it. Review your dependency tracking for “silent” fixes.
If you use Discourse: rebuild your Docker images now. A web-interface update alone may not replace the underlying libheif binary.
The researchers closed their report with a quote that sums up the moment we are in: “Security assumptions must catch up with attacker capabilities.”
The attackers are already using AI. Their costs are dropping. Their speed is accelerating. If your security posture assumes human-paced attacks, you are already behind.
We are not heading toward a future where AI-powered attacks are the norm. We are already there. The question is whether your defence posture has noticed.
