Cybersecurity researchers from Hacktron AI utilized Anthropic’s Claude AI model to exploit a vulnerability chain affecting OpenAI’s infrastructure. In under 72 hours, the team compromised employee ChatGPT and Codex accounts and demonstrated unauthorized access to an internal GitHub repository before the bugs were patched.
From Community Forum Vulnerability to Remote Code Execution
The attack vector originated on community.openai.com, the official OpenAI community forum running on the Discourse software platform. According to Hacktron AI’s disclosure, researchers discovered a critical weakness in the processing chain for HEIC and HEIF image files. Specifically, an issue within libheif—an open-source library relied upon for parsing high-efficiency image formats—allowed a specially crafted graphic payload to trigger memory corruption.
By chaining this parser flaw, the researchers achieved remote code execution (RCE) against the server environment hosting the Discourse instance. They quickly escalated privileges to secure administrative access over OpenAI’s community forum software.
The forum integrated an identity federation mechanism utilizing the “Sign in with OpenAI” authentication protocol. Security audits revealed a secondary flaw in how this authentication bridge handled cross-service tokens. By combining the HEIC file exploit with the authentication bypass, Hacktron compromised multiple employee accounts tied to ChatGPT and Codex.
Escalating Privileges to Internal Code Repositories
The real enterprise risk materialized when these compromised credentials bridged into broader corporate tooling. One of the hijacked Codex accounts possessed active permissions linked directly to OpenAI’s internal GitHub organization.
https://x.com/S1r1u5_/status/2100777801335095383
To quantify the threat vector without engaging in destructive espionage, the researchers directed the Codex model via the compromised session to submit an innocuous pull request into a private internal repository. This programmatic test confirmed that an active threat actor could leverage inherited developer credentials to inject code or exfiltrate proprietary source trees. Hacktron stated they intentionally refrained from viewing or downloading any confidential code payloads during the demonstration.
Accelerating Exploit Development with Claude Opus 5
What sets this incident apart is the velocity of the exploit engineering phase. The researchers deployed Anthropic’s Claude Opus 5 to assist in developing and refining the memory corruption exploit against libheif.
Writing zero-day exploits typically demands days of painstaking assembly debugging and heap manipulation. Claude cut that timeline down significantly. The AI model assisted in authoring the functional exploit payload and tailoring it to fit the specific constraints of the Discourse hosting architecture within hours. The researchers maintained human oversight throughout the engagement, directing the investigation, verifying execution states, and orchestrating the multi-stage attack chain.
The entire operation unfolded across a compressed timeline:
- July 23, 2026: Initial reconnaissance and vulnerability research begin.
- July 25, 2026: Researchers achieve remote code execution on the Discourse environment, subsequently compromising employee ChatGPT/Codex accounts and gaining access to internal GitHub resources.
- September 1, 2026: OpenAI issues a $6,500 bug bounty reward to Hacktron AI following the coordinated vulnerability disclosure.
OpenAI remediated the authentication and forum-adjacent issues roughly 14 hours after receiving the notification from the research team. Discourse also patched the underlying processing vectors.
Enterprise Security Realities in the Age of LLM-Assisted Offense
Public disclosures from Hacktron AI indicate no massive leak of user chat logs or consumer conversation histories occurred during the 72-hour window. The researchers deliberately throttled their telemetry collection after establishing proof-of-concept access.
Yet, the incident underscores a harsh reality for modern software engineering organizations.
OpenAI awarded the researchers $6,500 through its bug bounty program for the vulnerabilities attributed directly to its systems, while the Discourse-specific flaws were addressed via separate reporting channels. All identified vectors are now closed.
