Researchers Detail How They Found and Sold OpenAI a HEIF Bug

Security researchers at Hacktron AI describe finding and reporting a bug to OpenAI as part of a broader, months-long research project the team calls the HEIF Heist, which the team says also reached other companies running the same underlying image-decoding software, described separately in Hacktron's earlier writeup.

According to the team's account, the specific flaw they used had already been fixed in the upstream open-source project, but because no CVE identifier was ever issued for it, the fix never propagated down to companies still running the older, vulnerable version, including OpenAI at the time. The team says the research took about two months, involved three researchers, and cost under $3,000 in AI-token spending, and that an older Claude model got stuck on part of the exploit chain, while Claude Opus 5, a model from Anthropic, succeeded within hours of its release.

The team reports OpenAI paid a $6,500 bounty for the finding and fixed the underlying issue within 14 hours of being notified. Hacktron frames the more consequential risk as not OpenAI specifically, since it responded quickly, but every other company still running the same unpatched image-decoding software with no CVE prompting them to check.