The bug that let hackers into OpenAI was fixed months earlier. Nobody was told it mattered
&imwidth=600&imheight=450&format=webp&quality=medium "The bug that let hackers into OpenAI was fixed months earlier. Nobody was told it mattered")
The bug that let hackers into OpenAI was fixed months earlier. Nobody was told it mattered
The break-in that reached OpenAI's code began with a flaw in an image-decoding library. It had already been fixed by the software's developers months earlier — but the fix was never marked as a security fix and got no CVE identifier. So it never triggered urgent updates, and vulnerable versions kept shipping inside widely used systems.
The path into OpenAI's internal code started somewhere mundane: a library that decodes iPhone photo formats. And the flaw it relied on was not a secret. It had already been fixed.
The problem is that almost nobody knew the fix mattered.
The Silent Fix
The bug sat in libheif, open-source software used to read HEIC and HEIF images. Its developers had corrected the underlying error some time before the OpenAI incident.
But the correction was not labelled as a security fix, and it was never assigned a CVE — the standard identifier that catalogues a known vulnerability and signals to the world that systems need updating. Without that label, the fix looked like any other routine code change.
Why A Label Decides Everything
Trending Stories
&im=FitAndFill=(700,400))
)
)
&im=FitAndFill=(700,400))
)
)
)
)
)
)
&im=FitAndFill=(700,400))
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
&im=FitAndFill=(700,400))
)
)
)
)
Modern software defence runs largely on CVE identifiers. Scanners look for them, patch schedules prioritise them, and alerts fire when a new one affects something a company runs.
A security fix with no CVE is invisible to all of that machinery. It gets bundled into a normal release, upgraded whenever a system happens to update, and ignored by every tool built to chase down known risks. The hole is closed at the source and left wide open everywhere the source has not yet flowed.
How It Reached A Live Target
That is precisely what happened here. The vulnerable version of the library shipped inside a standard Debian operating-system image — the base that a great deal of internet infrastructure is built on. A newer Debian release carried a still-vulnerable version as well.
OpenAI's community forum was running on that foundation, which is how an image uploaded to a discussion board became the first step toward the company's source code. The weakness was not exotic. It was a fixed bug that never got the paperwork that would have forced anyone to hurry.
The Argument On The Other Side
It is worth being fair to the library's maintainers, who are typically volunteers.
Not every bug fix is recognised as security-relevant at the time it is made; a memory error can look like an ordinary crash until someone works out how to weaponise it. Assigning CVEs is itself work, often unpaid, and demanding that every open-source project formally classify every fix is a real burden on people maintaining critical software for free. The failure here is systemic, not obviously anyone's individual fault.
But the consequence stands regardless of blame. The safety of enormous amounts of infrastructure depends on volunteers correctly guessing, in the moment, which of their fixes an attacker will later find valuable.
The Uncomfortable New Factor
This is where AI changes the picture. Deciding whether a quietly patched memory bug can actually be turned into a working attack used to require a scarce expert and considerable effort — a filter that kept many silent fixes harmless in practice.
When a model can attempt that conversion cheaply and quickly, the buffer disappears. Every undocumented fix in widely used software becomes a lead an attacker can afford to chase, whether or not anyone ever labelled it a risk.
What To Watch
Whether ecosystems that depend on open-source libraries invest in the unglamorous work of classifying and back-porting security fixes. Whether funding reaches the volunteer maintainers who carry this load. And whether 'it was already fixed upstream' stops being treated as reassurance — because a fix nobody was told to apply protects nobody.
