How OpenAI got hacked with an image

LiveOverflowSeptember 18, 2026AppSec Vulnerabilities AI

MentionsOpenAI

Plays from YouTube in privacy-enhanced mode — nothing loads from YouTube until you press play.

Two guys hacked OpenAI with a malicious HEIF image. They turned a one year old libheif heap overflow into a remote code execution on OpenAI's Discourse forum, took over an employee's ChatGPT account, and left a message in the internal monorepo. This story shows how AI changes the economics of exploit development and why security through complexity doesn't work anymore.

Description from LiveOverflow.

Watch on YouTube

More in AppSec

PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert

The Hacker News4h agoAppSecVulnerabilities

SANS Stormcast Wednesday, October 21st, 2026: eMudhra Intermediate CA Certificates Revoked; Critical PHP Security Release; Oracle CPU E-Business Suite SQLi (CVE-2026-101767); FortiSIEM gRPC RCE PoC

Podcast6 minSANS Internet Storm Center StormCast7h agoAppSecEndpointVulnerabilitiesCVE-2026-101767

Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution

The Hacker News17h agoAppSecVulnerabilitiesCVE-2026-106173

AOMEI Backupper Compromised in Short-Burst Supply Chain Campaign

SecurityWeek19h agoThreat IntelAppSecEndpoint

SANS Stormcast Tuesday, October 20th, 2026: Plex2Shell RCE Exploited; Broadcom eCos Wi-Fi RCE; OVHcloud CLI Compromised; Exchange Issues After October Updates; AI Agent Containment; VBA in DWG YARA

Podcast7 minSANS Internet Storm Center StormCastyesterdayAppSecVulnerabilitiesAI