Researchers Used Claude to Reach OpenAI Repos, Won $6,500

A three-person team at the security startup Hacktron AI chained two vulnerabilities on 25 July 2026 to take over multiple OpenAI employee ChatGPT and Codex accounts, and through one of them reached OpenAI's internal GitHub repositories. The researchers — Harsh Jaiswal, Mohan Pedhapati and Rahul Maini — published their full write-up on 13 September, and the case drew wide attention after The Wall Street Journal reported it on the evening of 17 September.

The entry point was an image upload. OpenAI's community forum runs on Discourse, which handed HEIF and HEIC files to ImageMagick, which in turn passed them to the libheif decoder. According to Hacktron's account, the Discourse Docker image was based on Debian 12 and shipped libheif 1.19.7 without a security backport: an upstream fix from the previous year had not been documented as a security change and carried no CVE, so distributions never picked it up. A specially crafted image triggered a heap buffer overflow and gave the team code execution on the forum server. From there, Hacktron says, a misconfiguration in OpenAI's own single sign-on — not anything specific to Discourse — turned that foothold into account takeover.

What made the write-up travel is the tool. Hacktron says Claude Opus 4.8, which TechCrunch reports is a build Anthropic makes available to security researchers, spotted the missing backport but \"struggled across several sessions to produce a working exploit\" once memory-layout randomisation was switched on. Anthropic released Claude Opus 5 that evening. \"Within hours of Opus 5's release, we gave it the same problem and it succeeded,\" the team wrote. The new model produced a working ARM64 exploit in about three hours, then ported it to the x86-64 configuration Discourse uses.

Hacktron frames the result in cost terms. Its wider research campaign against libheif across several large platforms ran for two months, used three researchers and under $3,000 of model tokens, with each new target taking one or two days to adapt. The team says it is aware of only one company, Shopify, that detected the activity. \"For $200 a month, anyone can use these tools and hack into a company like OpenAI,\" Matt Fredrikson, chief executive of the AI security firm Gray Swan, told TechCrunch.

To prove the access without reading proprietary code, the researchers had the employee's Codex open a harmless pull request in OpenAI's internal monorepo, then stopped testing at about 15:30 UTC. OpenAI confirmed a fix the same evening, roughly 14 hours after the Bugcrowd report, and paid a $6,500 bounty on 1 September, noting that the Discourse-hosted forum was excluded from its bounty scope and that the award covered the OpenAI-side finding. Discourse had a fix ready by 27 July and published advisory GHSA-vhm9-85gw-x335, tracking the issue as CVE-2026-32882 at high severity, on 28 July, adding sandboxing for image processing. OpenAI says the issues are resolved; Hacktron says it is continuing the research across other frontier labs.

Disclosure: NewUJ's editorial process uses Anthropic's Claude models.