Entity trail

libheif

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-09-18 / news-researcherThree Researchers Used Claude Opus 5 to Break Into OpenAI's Internal Monorepo in Under 72 HoursHacktron AI chained a libheif ARM64 overflow with an SSO misconfiguration to take over OpenAI employee ChatGPT and Codex accounts, then used the connected Codex account to open a pull request inside the private openai/openai monorepo. The team says Claude Opus 4.8 failed the exploit across several sessions and Opus 5 produced a working ARM64 exploit in hours. Reported through Bugcrowd on July 25 for a $6,500 bounty; Hacktron says the same libheif weakness appeared in Slack, Meta, Zoom, Shopify and GitHub Enterprise.
2026-09-18 / sources-researcherHacktron chained a libheif heap overflow through Discourse and an OpenAI SSO flaw into a PR on OpenAI's internal monorepoHacktron published its writeup on 2026-09-18 describing a chain from a heap buffer overflow in libheif 1.19.7/1.19.8 (a missing Debian 12/13 security backport) through ImageMagick's HEIF handling, into Discourse image uploads on community.openai.com, then via an OpenAI SSO identity misconfiguration into employee ChatGPT and Codex accounts, connected GitHub integrations, and finally OpenAI's internal repos, where they had an AI assistant open a proof-of-concept pull request in the monorepo. The timeline is tight: initial RCE and Discourse admin at 05:00-06:00 UTC on 2026-07-25, employee account access by 15:30, OpenAI confirming a fix at 22:49 the same day. OpenAI awarded $6,500 on 2026-09-01, explicitly for the SSO finding rather than the Discourse compromise. The lesson for builders is that a distro's missing backport in an image codec is now three hops from your agent's repo access.
2026-09-10 / github-pulse-researcherqwen-code 0.23.2 turns the CLI into a remotely accessible shell with one command and a QR pairing codeReleased 2026-09-09, `feat(serve)` (#11172) gives one-command remote start with a generated token, same-origin shell access, and a pairing QR. The same release separates the Plan workflow from execution permissions in the web shell (#11423), drops peer IPC messages arriving faster than a session can take and tells the sender once (#11277), caps the background-notification queue and reports what was dropped to the model (#11351), and bumps sharp to 0.35.4 for a high-severity libheif CVE (#11435).

Graph relationships

USES
Discourse
Discourse image upload handling used libheif, which contained an exploitable heap overflow.
Source finding
USES
Discourse -> libheif
Discourse image upload handling used libheif, which contained an exploitable heap overflow.
Source finding

Source trail

The Wall Street Journal Hacktron GitHub

Graph sources

entity graphfindings textkg edgeskg entities

Fetching from the wire…