Hacking OpenAI

Security researchers found that OpenAI's help forum accepted image attachments processed through libheif, a HEIF image decoder with a known heap overflow. By crafting a malicious image and pairing the resulting code execution with a separate single sign-on flaw, they moved from an external support ticket to authenticated access inside OpenAI's internal ChatGPT and Codex tooling. To prove the chain worked without causing damage, they submitted a harmless pull request to an internal repository, a common proof-of-impact technique in bug bounty work that demonstrates write access without altering production code. They then disclosed the chain through OpenAI's bounty program and received $6,500.

The finding is a reminder that support and help desk surfaces are often lower scrutiny entry points than a company's primary product, and that image and file parsing libraries remain a durable class of memory safety bug even in mature codebases. For teams running their own support tooling or agent connectors that accept file uploads, the practical lesson is to treat every parser in that path, image decoders included, as attack surface worth auditing and sandboxing, not an afterthought bolted onto a ticketing system.