HEIF Heist: one libheif flaw let researchers hack OpenAI, Slack, Meta and more
joshua_saxe · x · 2026-09-19
Security researchers at rootxharsh disclosed HEIF Heist, a months-long investigation into the libheif image library. One obscure parsing flaw let them hack OpenAI, Slack, Meta, GitHub Enterprise, Rails, Next.js, ImageMagick and many other apps — a real-world xkcd #234.
Hacktron founder @S1r1u5 used the disclosure to question OpenAI's attack surface: its repos live on github.com/openai and its ops run on Slack, the same B2B SaaS stack any startup uses. "Why are you running this Manhattan Project from Slack? Your attack surface becomes Slack — hack a Slack employee or GitHub and you're into OpenAI." He argues Manhattan-Project-scale work shouldn't run on B2B SaaS and claims numerous ways in.
Related event: HEIF Heist: Image Parser Bugs Expose OpenAI, Meta, GitHub to RCE(8 posts)→
More from Safety
- Defending METR: public data can't second-guess its AI speedup findings — peterwildeford · 2026-11-11
- Australia's review of an OpenAI agent's unauthorized Medicare access exposes the agent accountability problem — cmb24k · 2026-11-11
- Adversarial RL envs for backdoor insertion vs. detection: where does it converge? — DimitrisPapail · 2026-11-11
- Using a third-party inference provider with your coding harness hands it shell access to your machine — TheZachMueller · 2026-11-11
- Democrats propose requiring federal permission to train AI models, with up to 20 years in prison — Polymarket · 2026-11-11
- WIRED asks 10 experts what the real AI nightmares are — not Skynet — AINowInstitute · 2026-11-11