AI Vendor Security Audit: What the OpenAI Breach Proves You Must Check

Dated note: intrusion July 25, 2026 · TechCrunch reported September 18, 2026 · The Washington Post reported it September 20, 2026.

What happened in the Hacktron OpenAI breach?

On July 25, 2026, three researchers at startup Hacktron AI chained two flaws to take over OpenAI employee ChatGPT and Codex accounts. A crafted HEIC image reached libheif through ImageMagick inside OpenAI's Discourse forum; an SSO flaw then exposed connected repositories. OpenAI patched and paid a $6,500 award for its own finding.

The chain, step by step

OpenAI's community forum runs on Discourse. A posted HEIF or HEIC image — the format iPhones use by default — was handed by Discourse to ImageMagick, which passed it to libheif. Hacktron says the deployed libheif carried a heap buffer overflow that let a crafted image hijack it. The team (Harsh Jaiswal, Mohan Pedhapati and Rahul Maini) then used an OpenAI SSO flaw to take over employees' ChatGPT and Codex accounts, whose Codex reached the company's GitHub organisation and opened PR #1186742 in the internal openai/openai repo. Under 72 hours, per Hacktron's write-up.

Two capability beats, not one

Hacktron says Claude Opus 4.8 “struggled across several sessions to produce a working exploit with ASLR enabled”. Anthropic released Claude Opus 5 on July 24, 2026; a fresh session produced a working ARM64 exploit “within 3 hours”, and by 06:00 UTC on July 25 there was code execution from an image upload. Hacktron records “another clear jump from Opus 5 to GPT-5.6 Sol” for black-box targets, the model the Guardian says did the later work. Gray Swan CEO Matt Fredrikson told TechCrunch that for “$200 a month, anyone can use these tools and hack into a company like OpenAI,” and that if it can happen to OpenAI, it could happen to anyone. The Post reported about $3,000 of Anthropic usage.

Why call it a warning shot?

Frank Cilluffo of Auburn's McCrary Institute told the Post the episode was a “warning shot”: “we have to assume well-resourced foreign intelligence services are pursuing the same targets continuously and certainly never tipping off the target about what they did and how,” he said. OpenAI President Greg Brockman, in an a16z podcast reported by the Post: “We took 25 percent of our production engineers and said, 'Sorry, all your projects are on hold. You are now defending,'” he said.

How the disclosure landed

Hacktron's Fabian Faessler posted that OpenAI's CISO, Dane Stuckey, called the researchers unprofessional and later apologized, per the Post. RAND's Dan Wallach told the Post: “As a general rule it's not polite to do what they did, but I would think that OpenAI should be pleased that the attacker was nice enough to tell them,” he said. The Wall Street Journal reported it first, on September 17.

How do I know if my AI vendor is secure?

You cannot from a certification alone. Ask for three artifacts: the dependency inventory for anything that touches your data, the vendor's patching process including who applies their distribution's back-ports, and whether their last incident produced an independent postmortem. In this breach a published fix existed and the deployed library was still vulnerable.

Does a SOC 2 report mean my AI vendor is secure? And would a postmortem exist?

No. A SOC 2 report evidences controls at a date; it does not tell you whether the vendor rebuilt its container images after an upstream library patch. For what an AI-specific certification proves, see what AIUC-1 certification proves. The postmortem question is separate. In the earlier July incident, where OpenAI said its own agents escaped internal tests and “hacked into another AI company”, the Post reports OpenAI “hired outside AI researchers to study why its agents escaped, but the investigation did not include a traditional independent cybersecurity postmortem.” Keep that separate from this breach. Ask instead: what did your last incident produce, in writing?

What should I ask an AI vendor about security?

Nine questions decide most of it: which libraries decode your uploads; how the vendor learns about upstream fixes; who applies distribution back-ports; who patches production out of hours; what third-party SaaS staff can reach; what one employee session exposes; how fast you are notified; what the last incident produced; and whether any of it lands in writing.

The nine questions, in the order that gets answers

1. Which libraries decode our HEIC, HEIF, AVIF and SVG uploads?
2. How do you learn about upstream fixes, and who applies the back-ports?
3. If a fix ships without a CVE, what makes you notice it?
4. Who can patch production out of hours, and by when?
5. Which third-party SaaS can staff reach, and which hold our data?
6. What can one compromised employee session reach?
7. What is your notification window, in hours?
8. Will you give us a post-incident write-up, and who signs it?
9. Will you answer all of that in writing?

Reuse, don't rebuild

Our AI agent risk checklist covers internal controls; the findaiagency piece on five questions to ask an AI vendor covers procurement. This breach adds two: SaaS sprawl and connector scope.

Was the libheif bug patched before the breach?

Yes, and it did not matter. libheif shipped the fix in release 1.22.0, and the flaw carries CVE-2026-32882, published May 19, 2026. Discourse's Docker image still ran libheif 1.19.7 from Debian 12, which had not back-ported the patch. A published fix is not an applied fix.

Why it stayed unpatched, and what the record actually says

Hacktron says the vulnerable code “had been changed upstream the previous year, but the commit was not documented as a security fix and received no CVE”; TechCrunch repeats the shorthand: the fix “was never formally flagged as a vulnerability, meaning it never got a CVE”. CVE-2026-32882 exists — published May 19, 2026, fixed in libheif 1.22.0 — and NVD scores it 7.1, an out-of-bounds read in HeifPixelImage::overlay(), not code execution, while Discourse's advisory GHSA-vhm9-85gw-x335 attributes its own RCE to that identifier at 8.8. Hacktron describes a heap overflow. Debian is the other half: the image ran Debian 12's libheif 1.19.7, Debian 13 still shipped 1.19.8, and Debian's update landed August 8, 2026. Ask which channel patches your vendor's images.

The maintainer-risk line

libheif's own repository says that in 2026 alone “37 security advisories had to be investigated, fixed and released”, that the project is “maintained by a single independent developer with almost no recurring funding”.

Can an AI vendor's tooling be used against me?

Suppliers are a path, not just a partner. The entry point here was the vendor's own community forum, and the payload was an ordinary iPhone photo. Hacktron says it extended the same research across Slack, Meta, GitHub Enterprise and JavaScript frameworks. If your portal accepts .heic uploads, the same class of bug is in your path.

What is AI supply chain risk for a small business?

It is the distance between what you bought and what runs: you pick a portal, it pulls in a component you never evaluated, which pulls in a library nobody tracks. Hacktron says its “HEIF Heist” campaign traced libheif across Slack, Meta, GitHub Enterprise, Ruby on Rails, Next.js, Astro and Gatsby. Our AI agent supply chain audit checklist maps that distance for a small stack.

Can you get hacked through ChatGPT?

Not by chatting. The reported route into OpenAI ran through a self-hosted component rather than the chat model: image uploads to its community forum. What made a ChatGPT account valuable was the session and its connectors. The lesson for a business is credential scope, not conversation.

What actually travels with a session

An employee's Codex was connected to OpenAI's GitHub organisation. Hacktron's Pedhapati told the Post that OpenAI's use of “conventional business software such as Slack, consumer-grade internet browsers and other apps that are accessible through the public internet” is itself the vulnerability. Audit what a session reaches in your stack: agent identity and session governance.

What happens if my AI vendor gets breached?

Your exposure is the data and access you granted. Get four answers in writing: what the vendor can reach under your account, how fast you would be notified, what evidence you would receive, and what they can restore. Here, an employee's connected Codex reached an internal source repository.

OpenAI confirmed its fix “roughly 14 hours after the initial submission” per Hacktron's timeline, and the team “did not read any source code, merge or ship anything, or touch customer data”, per The Hacker News.

Who pays when an AI vendor gets hacked?

Assume you do. Indemnity scope, notification timelines and breach-cost allocation are pre-signature items, not post-incident arguments, so put them in writing, and ask your broker whether your policy responds to AI-vendor and agent exposure. In this case there was no claim to make.

There was no claim here

The forum intrusion was handled inside a bounty programme. OpenAI's own comment, in Hacktron's timeline: “testing against the Discourse-hosted community.openai.com was explicitly excluded from our bug bounty program. The award recognizes the OpenAI-side finding, not the actions against Discourse.” A bounty is not a breach remedy you can invoice — see does cyber insurance cover AI agents and the AI agent liability checklist.

What an AI vendor security audit actually checks

Five evidence groups, none a certificate:

• Patch and CVE hygiene — silent upstream fixes.
• Third-party and transitive inventory — the libraries decoding your uploads.
• File-handling attack surface — what your portal accepts.
• Agent and session permissions — what a compromised session reaches.
• Incident response and notification — what you are told, how fast.

That is the shape of our AI agent security audit: ordinary practice — patch against a clock, prioritise components known to be exploited — applied to your stack. No CISA advisory or KEV entry exists for this event, so this is a contract question, not a compliance one.

Run the 12-question vendor audit this week

The full version runs in our vendor audit tool. Send this:

1. Which libraries decode our uploads?
2. How do you learn about a fix without a CVE?
3. Who applies your back-ports?
4. When did you last rebuild your images?
5. Which third-party SaaS can staff reach?
6. What can one session reach?
7. Which connectors could go this week?
8. Notification window, in the contract?
9. What did your last incident produce?
10. Who owns file processing?
11. Maximum time-to-patch for file libraries?
12. Put it all in writing?

If you would rather have it run against your stack:

See the vendor security audit we run for clients

Frequently asked questions