In late July, three researchers at security startup Hacktron AI — Harsh Jaiswal, Mohan Pedhapati and Rahul Maini — used Anthropic's Claude Opus 5 to chain together an exploit that walked from OpenAI's developer forum straight into OpenAI's internal code repository. The team published the full writeup on their blog on September 13, and this week both The Wall Street Journal and The Information followed up, bringing wider attention to the case.
The chain started with a single image and ended inside OpenAI's main repository, openai/openai. As proof, the researchers opened a harmless pull request (#1186742) inside it, without touching any sensitive data.
A Single HEIF Image Breaks Into the Forum
OpenAI's developer forum, community.openai.com, runs on Discourse. Discourse's built-in image library doesn't recognize the HEIF format, so uploads in that format get handed off to ImageMagick, which in turn calls libheif to decode them.
The problem sits inside libheif. It has a heap buffer overflow, and the 1.19.7 build shipped in Debian's repository never received the corresponding security backport. Using that gap, the researchers crafted a malicious HEIF image that, once uploaded, gave them remote code execution on the forum server. Hacktron says the affected libheif versions run from 1.19.7 through 1.23.x, spanning multiple Linux distributions.
Taking over the forum server was only step one. The server held authentication tokens for logged-in users, including OpenAI employees, and the researchers found that some of those forum tokens worked directly on ChatGPT. Hacktron underlined the point in its writeup:
"The vulnerability to escalate is not Discourse-specific. It is an OpenAI SSO issue"
The bug that let them escalate privileges wasn't specific to Discourse — it was a flaw in OpenAI's single sign-on.
Through that gap, the researchers took over several employees' ChatGPT and Codex accounts. One employee's Codex was linked to OpenAI's GitHub organization, so the researchers sent that Codex instance a prompt telling it to open a pull request inside the internal repository. According to Hacktron, the same SSO also reached services like Slack and email, but the team left those untouched.
Opus 4.8 Couldn't Do It, Opus 5 Took Three Hours
The writeup spends the most time on what the model actually did. The libheif overflow is hard to exploit in an environment with ASLR (address space layout randomization) turned on, and the team had already spent several sessions trying with Claude Opus 4.8 without success.
"Opus 4.8 struggled across several sessions to produce a working exploit with ASLR enabled. Within hours of Opus 5's release, we gave it the same problem and it succeeded."
Opus 4.8 struggled across multiple sessions to produce a working exploit with ASLR enabled; within hours of Opus 5's release, the team gave it the same problem, and it succeeded.
By the team's timeline, Opus 5 shipped on July 24. Within about three hours, the model first produced a working exploit for a local ARM64 machine, then ported it to the x86-64-plus-jemalloc environment the Discourse server actually ran. The researchers set Claude loose in an autonomous loop against a Discourse Cloud instance they'd set up themselves; checking back the next morning, it already had code execution and had read out /etc/hosts as proof. The same script then worked, unchanged, against OpenAI's own instance.
From discovery to full compromise took roughly 72 hours. Hacktron says the whole project, which it calls "HEIF Heist," cost under $3,000 in tokens.
This isn't the first time the company has used Claude to write exploit code. It previously published a writeup on using Claude Opus to build a Chrome exploit, and concluded then that the model could handle most of the work but still needed a human to push through the critical steps. This time, in the chain running from the forum to the code repository, the human share of the work dropped noticeably — by the team's account, the Discourse exploit itself was written almost entirely by the model.
The Fix and the Bounty
OpenAI didn't move slowly. After the researchers reported the bug on July 25, OpenAI confirmed a fix in about 14 hours, at 22:49 UTC that same day. Discourse acknowledged the report on a Sunday and shipped a fix the following Monday. On September 1, OpenAI paid out a $6,500 bug bounty.
So far, the only account of what happened comes from Hacktron. Whether OpenAI checked the forum server's access logs from before the fix, whether anyone else exploited the same chain, and whether employee tokens were uniformly invalidated — none of that has been disclosed as of publication.
For developers, two things here are worth checking against your own setup: first, teams running self-hosted Discourse or similar community platforms should note that the ImageMagick and decoder libraries in their image pipeline often lag behind the main application in getting patched; second, for companies that put a forum, a ticketing system and the core product behind the same single sign-on, how far a token can travel once an edge service is breached depends entirely on how narrowly that SSO's scope is set.
Sources: Hacktron AI technical blog, The Wall Street Journal, CocoLoop, The Information; the exploit chain, 72-hour timeline, 14-hour fix, $6,500 bounty and under-$3,000 token cost are as verified in Hacktron's blog post.