AI is helping people exploit cybersecurity vulnerabilities — and even the AI labs theselves aren’t safe.
A team of security researchers has revealed that they used Anthropic’s Claude models to chain together two vulnerabilities that ultimately let them take over OpenAI employees’ ChatGPT and Codex accounts, gain access to OpenAI’s internal code repositories, and even open a pull request inside the company’s private monorepo, all without OpenAI’s staff realising anything was wrong.
The findings come from Hacktron AI, a security research outfit whose team, led by Harsh Jaiswal along with Mohan Pedhapati and Rahul Maini, has spent months hunting for vulnerabilities at frontier AI labs. In a detailed writeup, the researchers explained how they went from a fairly obscure bug in an open-source image-decoding library to sitting inside OpenAI’s own GitHub organisation, in well under 72 hours.
How It Started With An Image Upload
The starting point wasn’t OpenAI’s flashy AI products at all, but its comparatively mundane help forum, community.openai.com, which runs on the popular forum software Discourse. OpenAI also allows people to sign in to that forum using “Sign in with OpenAI,” a single sign-on system tied to the same identity infrastructure that powers ChatGPT and Codex accounts.
The researchers figured that if they could compromise the forum, that SSO connection might give them a path into much bigger things. To get there, they needed a way to run their own code on OpenAI’s Discourse server.
They found their opening in image uploads. Discourse normally screens uploaded images with a tool called FastImage, but since FastImage doesn’t support the HEIC/HEIF photo formats that iPhones commonly produce, those files get handed off to ImageMagick instead, which in turn relies on a library called libheif to actually decode them.
Working with Claude Opus 4.8 inside a Discourse Docker environment, the team asked the model to comb through the installed libheif package for security issues. It surfaced something significant: certain security fixes to libheif had never been “backported” into the version Discourse’s Debian-based Docker image was using, leaving open a heap buffer overflow that could be triggered simply by uploading a crafted image. Oddly, the underlying code had actually been quietly changed upstream the previous year, but without being flagged as a security fix or assigned a CVE, which is likely why it slipped through Debian’s usual patching process. Even the newer Debian 13 was still shipping a vulnerable version of libheif at the time.
Opus 5 Arrives Mid-Hack
Getting from “there’s a bug” to “this bug gives us code execution” took real work. Claude Opus 4.8 managed to build a working exploit fairly quickly once address space layout randomisation (ASLR), a common memory-protection defence, was switched off, but it struggled across several sessions to make the exploit reliable with ASLR turned back on, which is the default, more realistic setting.
Then, in the middle of this effort, Anthropic released Claude Opus 5. The researchers started a fresh session with the new model, and it produced a working exploit for a local Mac within three hours. When asked to port that exploit to the exact software environment Discourse actually runs, Claude Opus 5 delivered again. By 6 AM on July 25, the team had confirmed remote code execution on their own machine through nothing more than an image upload.
From there, they set Claude loose in an autonomous loop against their own cloud-hosted Discourse instance, routing the target through a URL designed to look like a defensive security exercise since Opus reportedly refused to write exploits against what looked like a live target. Within a few hours, the agent had achieved remote code execution on that instance and proved it by reading a system file. Using the resulting exploit script, the researchers then successfully compromised OpenAI’s actual Discourse-hosted forum.
From A Forum Bug To OpenAI’s Private Code
This is where the second vulnerability came into play. Because OpenAI’s SSO tied the forum into the broader ChatGPT and Codex ecosystem, compromising Discourse turned into “no interaction account takeover” for any employee who had logged into the forum. The researchers stress this wasn’t really a Discourse-specific flaw at all; any OpenAI-linked service using that same SSO setup could have offered the same path in.
To prove the severity of the access without crossing an ethical line, the team took over one employee’s account whose Codex, OpenAI’s AI coding agent, was connected to OpenAI’s GitHub organisation. Rather than poke around in OpenAI’s actual source code, they simply sent a prompt to that employee’s Codex session asking it to open a pull request in OpenAI’s internal monorepo, openai/openai, as harmless proof that they were in. The PR (numbered #1186742) went through, and the researchers immediately stopped testing and filed their report.
A Fast Fix, And A Modest Payout
OpenAI moved quickly once alerted, confirming a fix roughly 14 hours after the initial submission through its Bugcrowd-run bug bounty programme. Discourse, separately notified through HackerOne, had a patch ready within days and added extra sandboxing around its image-processing pipeline as a further precaution.
OpenAI ultimately paid the researchers a $6,500 bounty, though it clarified that the reward covered only the OpenAI-side identity flaw, since testing directly against the Discourse-hosted forum fell outside the programme’s official scope.
Bigger Than One Forum
The libheif bug didn’t stop at OpenAI. Hacktron has since expanded the work into a broader investigation called “HEIF Heist,” tracing the same vulnerable library across services from Slack to Meta to GitHub Enterprise, as well as popular web frameworks. According to the researchers, the entire two-month, three-person effort across all these targets cost less than $3,000 in AI tokens, with adapting each new exploit to a fresh company typically taking just a day or two.
The team’s broader point is less about any single bug and more about how fast frontier AI models are compressing the time and expertise it once took to turn a known flaw into a working exploit. They note a clear jump in capability between Opus 4.8 and Opus 5 within the span of this single investigation, and describe using the models not just to find bugs but to help with privilege escalation and evading defences once inside a system. Anthropic itself acknowledged the industry-wide stakes of this shift only months earlier, when it disclosed that a suspected Chinese state-sponsored group had similarly weaponised Claude Code to automate the bulk of a real espionage campaign against roughly thirty organisations.
For OpenAI, the episode is a reminder that as AI companies race to build ever more capable coding agents like Codex, the security of the comparatively boring infrastructure sitting around those products, forums, SSO systems, image uploaders, can end up being just as consequential as the safety of the AI models themselves.