The popular tech-based webcominc xkcd has been prescient about many things, but AI has led to one of the most interesting examples yet.
Back in 2020, the xkcd ran a strip called “Dependency,” showing all of modern digital infrastructure as a towering, precarious stack of blocks, propped up at the very bottom by one thin, wobbly piece labelled “a project some random person in Nebraska has been thanklessly maintaining since 2003.” It was a joke about how much of the software world quietly runs on obscure, underfunded open-source libraries that nobody thinks about until they break.
Five years on, that joke has turned into a real security incident at OpenAI, and one of the underappreciated pieces holding up the stack turned out to be an image-decoding library called libheif, of the kind ImageMagick relies on to process photos.
The Setup: A Forum, Not A Chatbot
The breach didn’t come through ChatGPT itself. It started at community.openai.com, OpenAI’s own help forum, which runs on the popular forum software Discourse. Security researchers at Hacktron AI, led by Harsh Jaiswal along with Mohan Pedhapati and Rahul Maini, had been probing frontier AI companies for vulnerabilities, and they noticed that OpenAI let people sign in to that forum using “Sign in with OpenAI,” the same identity system tied to ChatGPT and Codex accounts.
If they could compromise the forum, they reasoned, that shared login might open a door into far more sensitive territory. What they needed first was a way to get their own code running on OpenAI’s Discourse server. Where The XKCD Joke Comes In
That’s where the old comic stops being an abstraction. Discourse normally checks uploaded images using a tool called FastImage, but FastImage doesn’t understand HEIC or HEIF files, the format iPhones commonly save photos in. So when someone uploads one of those, Discourse hands it off to ImageMagick instead, which in turn calls on libheif to actually decode the image.
Using Anthropic’s Claude Opus 4.8, the researchers went digging through the installed libheif package and found that certain security fixes had never been backported into the version bundled with Discourse’s Debian-based server image. That left a heap buffer overflow sitting exposed, exploitable simply by up a maliciously crafted photo. The underlying code had actually been quietly patched upstream a year earlier, but without ever being flagged as a security fix or assigned a CVE, which is likely why the fix never trickled down through Debian’s usual channels. Even the newer Debian 13 was still shipping a vulnerable build at the time. It’s a near-perfect real-world example of the xkcd comic’s warning: a tiny, unglamorous piece of shared infrastructure, quietly out of date, sitting underneath a company as prominent as OpenAI.
Turning A Bug Into A Break-In
Finding the flaw was one thing; turning it into working code execution was another. Claude Opus 4.8 managed to build an exploit once a memory protection called ASLR was switched off, but it repeatedly struggled to make that exploit reliable with ASLR left on, which is the realistic default setting.
Then, mid-investigation, Anthropic released Claude Opus 5. Given the same problem, the new model produced a working exploit for a local machine within three hours, and successfully adapted it to the exact server setup Discourse uses. By the morning of July 25, the researchers had working remote code execution confirmed on their own systems through nothing more than an image upload.
From there, they pointed an autonomous Claude agent at their own cloud-hosted Discourse instance, disguising it as a defensive security exercise since Opus had reportedly refused to attack what looked like a real target directly. Within hours, the agent had achieved code execution and proven it by reading a system file. The team then used the resulting exploit against OpenAI’s actual forum, and it worked. From A Forum Bug To A Pull Request In OpenAI’s Code
Because the forum’s login was tied into OpenAI’s broader account system, compromising Discourse meant the researchers could take over any employee’s ChatGPT and Codex account with no further interaction needed. To demonstrate the severity of what they’d found, without actually digging through OpenAI’s private code, they took control of one employee’s account and simply asked their connected Codex session to open a pull request inside OpenAI’s internal monorepo as harmless proof of access. The PR went through, and the team stopped testing immediately and filed a report.
OpenAI confirmed a fix within roughly 14 hours and paid a $6,500 bounty, while Discourse, alerted separately, shipped a patch within days and added extra sandboxing around its image pipeline. The researchers have since widened the hunt into a project called “HEIF Heist,” tracing the same vulnerable library across other major platforms, at a fraction of the cost such research would once have required.
The Bigger Lesson
The episode lands as a fittingly literal update to the old joke: the “random project from Nebraska” propping up modern software isn’t hypothetical, it’s a real image-processing library that, once outdated, gave researchers a path from a help forum into an AI company’s private code. And as capable coding agents like Claude and Codex increasingly get used on both sides of that equation, by researchers hunting bugs and by attackers trying to weaponise them, the unglamorous plumbing underneath every product may need a lot more attention than it’s historically gotten.