Claude helped researchers breach OpenAI’s accounts and code systems

• Hacktron AI says it chained a remote-code-execution flaw in OpenAI’s Discourse-hosted forum with a weakness in OpenAI’s single sign-on system.¹
• The researchers used Claude to develop and adapt an exploit for a flaw in libheif, an image-decoding library. The Discourse vulnerability was later listed as CVE-2026-32882.²
• The chain gave them access to multiple OpenAI employees’ ChatGPT and Codex accounts, including one linked to OpenAI’s private GitHub organisation.¹
• They demonstrated access by using an employee’s Codex account to open a harmless pull request in OpenAI’s internal monorepo, but say they stopped before reading internal code.¹
• OpenAI confirmed its side of the problem was fixed about 14 hours after the researchers’ report on 25 July 2026. It later paid Hacktron a $6,500 bounty.¹

The researchers were Harsh Jaiswal, Mohan Pedhapati and Rahul Maini of Hacktron AI. Their attack began with an uploaded HEIF image. A vulnerable version of libheif, called by ImageMagick inside the forum’s image-processing pipeline, allowed code execution on the server. From there, they used OpenAI’s sign-in system to reach employee accounts and connected services.¹²

The important failure was not simply an unpatched image library. It was the bridge between a public-facing forum and higher-value OpenAI services. Hacktron says any compromised service using the same OpenAI sign-in flow could have created a similar route into ChatGPT and Codex accounts.¹ The company has not publicly stated that customer data or production systems were accessed. The demonstrated impact was access to an internal repository and the ability to propose a code change, not a confirmed theft of source code.

Claude did not carry out the operation alone: the researchers supplied the targets, prompts and testing environment, and used human judgement throughout. But they say Claude Opus 5 produced a working exploit after earlier model attempts failed, helping compress the work from a specialist exercise into a few days, with only hours of human effort.¹ That is the wider warning for companies relying on obscure software bugs and technical complexity as a practical security barrier: increasingly capable models can turn those barriers into a much cheaper, faster attack surface.

Footnotes

1. Hacktron AI, “Hacking OpenAI” ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷

2. Discourse security advisory, “RCE via malformed HEIF file” ↩ ↩²