A specially crafted image. A vulnerable image-processing library. A shared sign-in flow. And an AI system capable of iterating through the hard parts of exploit development.
That was the chain described by Hacktron AI after its researchers responsibly disclosed vulnerabilities that gave them access to multiple OpenAI employee accounts and a path to an internal code repository. The team used an employee’s Codex session to create a harmless proof-of-concept pull request, then stopped testing and reported the issue. OpenAI confirmed a fix roughly 14 hours after the initial submission and later paid a $6,500 bounty.
This matters not because OpenAI was uniquely careless, nor because an AI acted as a completely autonomous hacker. Hacktron explicitly says skilled human guidance remained important. It matters because the research shows how AI is changing the economics of a sophisticated attack.
The scarce ingredient used to be expert time. AI is beginning to turn more of that time into compute.
The exploit chain in plain English
OpenAI’s community forum used Discourse. When users uploaded HEIC or HEIF images, the processing path exposed an underlying library called `libheif` to attacker-controlled files. Hacktron found that the deployed version contained a memory-corruption weakness. A malicious image could therefore do far more than display incorrectly: it could help an attacker execute code on the server.
That server compromise was only the first step. Hacktron then chained it with a separate OpenAI single sign-on issue. The combination reportedly enabled access to employee ChatGPT and Codex accounts and, through a connected GitHub integration, a private repository.
The lesson is familiar but important: breaches are often chains, not single catastrophic bugs. A vulnerable dependency opened the first door. Identity and integration design expanded the blast radius.
What is ASLR.
Address Space Layout Randomization, or ASLR, is a security feature that shuffles where a program places important components in memory each time it runs.
Think of a burglar who knows that a key is kept in a house, but the rooms and cupboards move every time the front door opens. Even if the burglar knows what the key looks like, they do not know exactly where to reach for it. ASLR creates that uncertainty for an attacker trying to turn a memory bug into reliable code execution.
ASLR does not remove the underlying bug. It makes exploitation less predictable.
In Hacktron’s account, an earlier model produced code execution when ASLR was turned off but struggled across several sessions when ASLR was enabled. A newer model then produced a working ARM64 exploit for a local Mac in about three hours and was subsequently used to adapt the attack to the x86-64 and allocator configuration used by Discourse. The complete path from initial discovery to repository access took less than 72 hours.
That does not prove ASLR is dead or that every implementation can now be bypassed on demand. It does show that conventional, static ASLR is easier to overcome when an AI can patiently test payloads, analyse crashes, preserve useful results and refine the next attempt at machine speed.
AI’s advantage is finessed brute force
“Brute force” can sound like blindly trying every possible answer. That is not what happened here.
The stronger description is "finessed brute force": high-volume calculated trial and error guided by technical reasoning where each trial is superior to the one preceding it.
An AI can generate a candidate exploit, observe the failure, interpret memory behaviour, adjust heap layouts or payload structure, port the technique to another architecture and repeat. It can combine persistence with context. Each attempt becomes evidence for the next one. improving the process on the fly and significantly increasing the likelihood of success.
That combination changes the attack equation:
- more hypotheses can be tested;
- environmental differences can be handled faster;
- exploit development can continue for hours without fatigue;
- knowledge from one target can be reused against similar technology stacks; and
- a small expert team can operate with the throughput of a much larger one.
Hacktron said its broader two-month “HEIF Heist” research cost under $3,000 in model tokens and that adapting the exploit to a new company usually took one or two days. Those figures are the clearest warning: the barrier is not disappearing, but it is falling quickly.
ASLR must evolve—and it cannot stand alone
Security teams should not switch ASLR off or dismiss it. They should stop treating it as a sufficient backstop.
More advanced randomisation can raise the cost again: finer-grained layout diversity, larger entropy, re-randomisation during execution and per-deployment diversity make it harder to reuse one working exploit everywhere. “AI-hardened ASLR” is not yet a single standard product category, but it is a useful design direction: defensive systems that detect automated probing, recognise repeated crash-and-refine patterns and change memory layouts or isolate workloads before the attacker converges on a reliable exploit.
But randomisation is still only one layer. A stronger design combines:
- memory-safe languages for new components and safer boundaries around legacy C/C++ parsers;
- rapid dependency inventory, patching and rebuilds, including indirect libraries buried inside containers;
- sandboxed image and document processing with minimal privileges and no unnecessary network access;
- hardware-backed protections such as control-flow integrity, pointer authentication or memory tagging where available;
- strict token scope, short-lived sessions and separation between community services and sensitive internal tools;
- least-privilege integrations so one compromised account cannot inherit broad GitHub, email or collaboration access; and
- monitoring that treats repeated malformed uploads and image-processor crashes as a security signal.
Discourse’s response illustrates the point. Its advisory says the patched Docker image includes the fixed library, while supported versions also add image-processing sandboxing as defense-in-depth. The patch removes the known flaw; the sandbox limits the damage if another parser bug appears tomorrow.
The strategic takeaway
AI is not creating memory-corruption vulnerabilities. It is compressing the discovery-to-exploitation cycle and making difficult techniques more repeatable.
That makes defense-in-depth more relevant, not less. Every layer should assume the previous one can fail:
- Assume a parser bug will exist.
- Assume ASLR may be bypassed.
- Assume a sandbox may be tested.
- Assume a token may be stolen.
- Design identity, privileges and monitoring so the chain still breaks.
The future of cybersecurity will not be decided by one perfect control. It will be decided by how many independent opportunities defenders create to stop an AI-assisted attacker before persistence becomes access.
Hacktron’s research is therefore not simply a story about one company being hacked. It is a signal that the economics of exploitation have changed. Defenders must now use the same advantages—automation, rapid experimentation and adaptive intelligence—to make their systems harder to learn, harder to exploit and far less rewarding to compromise.
Sources:
Hacktron AI, “Hacking OpenAI”: https://www.hacktron.ai/blog/hacking-openai
- Discourse security advisory, GHSA-vhm9-85gw-x335 / CVE-2026-32882: https://github.com/discourse/discourse/security/advisories/GHSA-vhm9-85gw-x335
- Vercel, “Reproducing, disclosing, and fixing the libheif vulnerability with Hacktron and the maintainers”: https://vercel.com/blog/reproducing-disclosing-and-fixing-the-libheif-vulnerability-with-hacktron-and-the-maintainers