Skip to content
Sign in
Artwork for Braid
Braid · September 18 · 19 min

Seventy-Two Hours and a Malformed Image

An authorized bug bounty ran from a malformed image upload to write access on OpenAI's internal repositories in under seventy-two hours, and the exploit work that had stalled on one model version came together in three hours on the next one. That's the tension today: defenders got faster, attackers got cheaper, and only one company on the internet noticed the traffic. Hacktron's write-up of the OpenAI engagement — a heap overflow in libheif, reached because Discourse hands unsupported image formats to ImageMagick, escalated through single sign-on into an employee's Codex. Confirmed GitHub access; Slack and email were theoretical scope only. libheif — the decoder at the bottom of the chain, version 1.19.7 on Debian 12. If your upload path falls back to a second decoder for unsupported formats, go find out which decoder, and which version. Harness ablation on tau-squared bench — a fixed harness versus a sham one moves results by 7.17 points, and 61% against 17% in one slice, for under a cent of compute. Some of what reads as model capability is the harness. MAGS multi-agent scaling — reports 100%, but against frozen specifications, which removes the hard part of software work. Read the setup before the headline number.

0:00 · Seventy-two hours to a pull request-19:22
Play in
Transcript file

transcript

No transcript — this publisher did not publish one.

show notes

An authorized bug bounty ran from a malformed image upload to write access on OpenAI's internal repositories in under seventy-two hours, and the exploit work that had stalled on one model version came together in three hours on the next one. That's the tension today: defenders got faster, attackers got cheaper, and only one company on the internet noticed the traffic.

  • Hacktron's write-up of the OpenAI engagement — a heap overflow in libheif, reached because Discourse hands unsupported image formats to ImageMagick, escalated through single sign-on into an employee's Codex. Confirmed GitHub access; Slack and email were theoretical scope only.
  • libheif — the decoder at the bottom of the chain, version 1.19.7 on Debian 12. If your upload path falls back to a second decoder for unsupported formats, go find out which decoder, and which version.
  • Harness ablation on tau-squared bench — a fixed harness versus a sham one moves results by 7.17 points, and 61% against 17% in one slice, for under a cent of compute. Some of what reads as model capability is the harness.
  • MAGS multi-agent scaling — reports 100%, but against frozen specifications, which removes the hard part of software work. Read the setup before the headline number.
links4

chapters

6 chapters

more episodes

All episodes