Key Notes
- Indian security startup Hacktron AI used Anthropic's Claude, including Claude Opus 5, to chain a heap buffer overflow in the libheif image library with an SSO misconfiguration, gaining access to OpenAI employee ChatGPT and Codex accounts and reaching OpenAI's private GitHub monorepo within 72 hours.
- The research was conducted through OpenAI's bug bounty program, which paid Hacktron a $6,500 reward after the vulnerabilities were patched.
- Hacktron said the entire investigation, part of a broader two-month project called HEIF Heist covering other companies as well, cost less than $3,000 in AI tokens total.
A three-person Indian security startup used Anthropic’s Claude to breach OpenAI’s internal systems in July, gaining access to employee ChatGPT and Codex accounts, reaching OpenAI’s private GitHub monorepo, and opening a pull request inside it, all within 72 hours and for under $3,000 in AI tokens.
The research, first reported by the Wall Street Journal and detailed in a technical writeup by the startup itself, Hacktron AI, was conducted through OpenAI’s bug bounty program. Hacktron reported the vulnerabilities it found, OpenAI patched them, and the company paid a $6,500 bounty. Hacktron’s three researchers, Harsh Jaiswal, Mohan Pedhapati and Rahul Maini, say the entire effort from initial discovery to internal repository access took less than 72 hours of combined agent and human time.
How the Exploit Chain Worked
According to Hacktron’s writeup, the researchers found that OpenAI’s help forum, hosted on Discourse at community.openai.com, routed HEIC and HEIF image uploads through ImageMagick, which in turn relied on a version of the libheif image decoding library that was missing a security backport. That gap allowed a heap buffer overflow during image decoding, giving attackers a path to remote code execution through an ordinary image upload.
The team used Claude Opus 4.8 to identify the missing backport and build an initial exploit with a security feature called ASLR disabled, but said the model struggled across several sessions to make the exploit reliable with ASLR turned on. The day Anthropic released Claude Opus 5, Hacktron started a new session with the updated model, which the researchers said produced a working exploit for a local Mac within three hours before being adapted to the Linux configuration Discourse actually runs. By the morning of July 25, the team had confirmed remote code execution and replicated the attack against OpenAI’s live forum.
From a Forum Bug to Internal Code Access
The forum compromise mattered because OpenAI’s single sign-on system let visitors log into community.openai.com using their OpenAI accounts without additional checks, meaning an attacker who took over a forum session could take over the same person’s ChatGPT and Codex accounts.
One compromised account had GitHub single sign-on connected directly to OpenAI’s internal code repository. Hacktron said the authentication tokens it obtained worked on both ChatGPT and OpenAI’s GitHub, and that some belonged to OpenAI employees with potential access to the company’s monorepo, which contains proprietary AI software but not model weights.
To demonstrate impact without exploring sensitive internal data, the researchers used one compromised employee account’s Codex session to open a pull request inside the private repository, then stopped testing and filed their disclosure. OpenAI confirmed the fix roughly 14 hours after the initial report, and Discourse, whose own platform carried the underlying flaw, published a security advisory and patch within days.
A Wider Pattern of AI-Accelerated Research
Hacktron said the OpenAI case was part of a broader two-month investigation it calls HEIF Heist, tracing the same libheif vulnerability pattern across Slack, Meta, GitHub Enterprise and several JavaScript frameworks, all for less than $3,000 in total token spending. The team said adapting a working exploit to each new target typically took one or two days once an initial exploit chain existed, and that it observed a clear capability jump between successive AI models over the course of the project.
The disclosure lands the same week OpenAI introduced a new framework for reporting when its own models behave unexpectedly, following the company’s acknowledgment that its agents used unauthorized external websites to coordinate during earlier incidents. Hacktron’s report draws a pointed contrast: where OpenAI has faced scrutiny over its own models acting outside intended bounds, in this case a rival’s model, run by outside researchers, was the tool that got past OpenAI’s defenses first.
Discourse, the forum software vendor whose dependency carried the underlying flaw, moved quickly once notified. According to Hacktron’s account, the company acknowledged the report the day after it was filed on a weekend and had a fix ready the following Monday, later publishing a public security advisory with patch and rebuild guidance and adding sandboxing around its image-processing pipeline as an additional defensive layer.
OpenAI confirmed its own side of the fix within roughly 14 hours of the initial submission. Hacktron said it was not aware of any other affected company detecting its testing activity during the broader HEIF Heist project, with one exception: Shopify, whose image processors it said repeatedly crashed under the load of test uploads.
Disclaimer: AIstify is an independent media brand owned and operated by NuvexMedia LLC, publishing news, research, and insights on artificial intelligence, emerging technologies, automation, and related industries. NuvexMedia LLC invests in and collaborates with companies across the AI, technology, software, and digital innovation sectors. These relationships do not influence AIstify’s editorial coverage, and the publication maintains full editorial independence to provide accurate, timely, and objective information. © 2026 NuvexMedia LLC. All rights reserved. This content is for informational purposes only and should not be considered legal, tax, investment, financial, or other professional advice.
