Claude-built libheif RCE chained to OpenAI forum token flaw exposed internal GitHub

The attack began at community.openai.com. Discourse passed unvetted HEIC uploads to ImageMagick and libheif; upstream fixes from a year earlier carried no security label so never entered patching pipelines. Claude generated and refined the remote code execution payload across multiple iterations until it worked against the live forum instance. Execution on the forum host then leveraged SSO tokens that granted unrestricted API access to linked accounts. OpenAI separated the issues in its response: the image library defect sat in third-party Discourse while the token scope error was internal. Researchers demonstrated by opening a pull request in an internal repo via a compromised employee Codex-linked GitHub account. OpenAI logs showed only metadata reads plus the test PR; no Slack access was verified. The firm fixed token permissions in 14 hours and paid a $6,500 bounty. Discourse added sandboxing within two days. The incident reveals a recurring pattern: AI lowers the bar for turning obscure dependency bugs into reliable exploits, while SSO token over-scoping turns any forum foothold into broad organizational access. No CVE existed, so standard vulnerability management missed the vector entirely. Future risk centers on similar unlabelled bugs in image, document, and archive processors across enterprise forums and support portals. Procurement records show growing Discourse adoption in government and defense-adjacent firms; identical chains are probable without mandatory sandboxing and least-privilege token audits.