AI-Assisted Libheif Exploit Gave Researchers RCE on OpenAI’s Community Forum

Summary

Harsh and Mohan used an AI-assisted exploit for an untracked Libheif heap overflow in Discourse image processing to gain RCE on OpenAI’s community forum, take over an employee ChatGPT account and access an internal repository; they reported the issue.

Key points

Harsh identified a heap buffer overflow in Libheif’s overlay calculation. The video says an earlier commit fixed it, but it had no CVE and the vulnerability was not being tracked.
Discourse routes HEIF uploads through ImageMagick for conversion, allowing a crafted image to reach the vulnerable Libheif code and trigger remote code execution.
The researchers adapted the exploit to OpenAI’s hosted community forum and used an OAuth weakness to take over an employee’s ChatGPT account; the video says other users’ accounts could also have been taken over.
They demonstrated access to an internal repository by creating a README pull request and say they avoided viewing privileged repository data.
The video says the researchers also used the vulnerability against Slack, Meta, and other targets, but provides no further technical details about those cases. It argues AI-assisted exploit development can lower the effort required to exploit complex bugs.
The researchers reported the issue to OpenAI. They received $6,500 for the escalation from Discourse to ChatGPT; the initial Discourse exploit was out of scope under the bounty policy.
For self-hosted Discourse, the presenter recommends rebuilding installations because a web-interface update may not be sufficient; Debian-based deployments should update Libheif.

Article Details

Topics: [01:40] Harsh’s image-processing research leads to examining Discourse and its dependencies
[03:23] Discourse HEIF upload handling creates a path to ImageMagick and Libheif
[05:44] AI-assisted discovery of the Libheif heap buffer overflow and vulnerable Debian packages
[08:54] Exploiting Discourse image uploads to reach OpenAI accounts and an internal repository
[11:32] Disclosure to OpenAI and the bounty-scope dispute
[13:22] Image-parser risks and the video’s claims about other affected targets
[15:16] AI-assisted exploitation and changing security threat models