Security researchers at Hacktron AI used Anthropic’s Claude to help develop an exploit chain that compromised OpenAI employee ChatGPT and Codex accounts and ultimately demonstrated access to an internal OpenAI GitHub repository. The research took place in July and was publicly disclosed this week after the vulnerabilities had been reported and fixed. OpenAI later paid Hacktron a $6,500 bug bounty for the OpenAI-side security issue.
The attack began with OpenAI’s community forum, which runs on the Discourse platform. Hacktron researchers Harsh Jaiswal, Mohan Pedhapati and Rahul Maini found that specially crafted HEIC and HEIF images could reach a vulnerable version of the libheif image-decoding library through Discourse’s image-processing pipeline. By exploiting the memory-corruption flaw, the researchers achieved remote code execution on a test Discourse environment and then demonstrated the same capability against OpenAI’s community forum.
Claude played a significant role in turning that vulnerability into a working exploit. Hacktron said Claude Opus 4.8 struggled across multiple attempts to produce reliable exploit code, but the situation changed after Anthropic released Claude Opus 5 on July 24. According to the researchers, Opus 5 produced a functioning ARM64 exploit for a local Mac within roughly three hours before helping adapt it to the x86-64 and jemalloc configuration used by Discourse.
Remote code execution on the forum was only the first part of the chain. Hacktron then identified a separate problem involving OpenAI’s sign-in system, where Community authentication tokens carried broader permissions than necessary. The researchers said this could allow accounts belonging to people who had signed into the forum to be taken over at the ChatGPT and Codex level, including accounts used by OpenAI employees.
That escalation substantially increased the potential impact because ChatGPT and Codex accounts can be connected to other workplace services. In the case Hacktron used for its demonstration, an OpenAI employee’s Codex account was connected to the company’s GitHub organization. Rather than examining proprietary source code, the team instructed Codex to create a harmless pull request in OpenAI’s internal monorepo, proving the level of access before ending further testing.
OpenAI confirmed that it addressed the account-takeover issue. The company said it narrowed the permissions associated with Community sign-in tokens and revoked affected tokens and sessions after receiving the report. Discourse separately patched its image-processing vulnerability and added additional sandboxing around ImageMagick, while the underlying libheif issue has since been tracked as a high-severity vulnerability.
The disclosure occurred through OpenAI’s Bugcrowd program, although the scope requires some distinction. Reporting indicates that testing against the Discourse-hosted community forum itself was outside OpenAI’s formal bounty scope, while the $6,500 award recognized the OpenAI-side sign-in vulnerability and resulting impact. Hacktron says the entire path from its initial discovery to demonstrating repository access took less than 72 hours.
The researchers argue that the incident illustrates how advanced coding models can reduce the time and specialist knowledge required to turn memory-safety bugs into usable exploits. Hacktron’s broader research effort, called HEIF Heist, examined similar image-processing attack surfaces across several major technology platforms. Anthropic has also documented attempts to misuse Claude for cyber operations in its own threat intelligence reporting on malicious uses of Claude.
The OpenAI incident is therefore notable for more than the initial forum compromise. A vulnerability in a third-party service, combined with overly permissive identity tokens and an employee account connected to developer infrastructure, created a path from an uploaded image to an internal software repository. The flaws have been patched, and the researchers say they deliberately avoided accessing sensitive internal code beyond what was necessary to demonstrate the security impact.
