Researchers Used Claude to Hack OpenAI's Internal Systems in a Bug-Bounty Chain

On 25 July 2026 a three-person team at the security firm Hacktron AI used Anthropic's Claude Opus 5 to chain two flaws and take over ChatGPT and Codex accounts belonging to OpenAI employees, then used one of those accounts to open a pull request inside OpenAI's internal source repository. The entry point was not a login page or an API key: it was an image upload on OpenAI's public help forum, community.openai.com, which runs on the open-source forum software Discourse. The second flaw was in OpenAI's own shared sign-on, not in the forum. No source code was read, nothing was merged, no customer data was touched, and the archive records no real-world harm — this was security research reported to the vendor, not an attack on it. The record is dated 18 September 2026, the day TechCrunch reported the finding. This incident sits alongside the other documented entries in the Orca AI Incident Archive, where each record carries its own sources, severity, confidence grade and disputed flag.

Two things make the case more than a colourful bug-bounty story. The first is the speed: Hacktron says the whole path from first looking at the forum to holding internal repository access took under 72 hours, and that the model it started with could not do the job. The second is a discrepancy the headline numbers hide — the CVE that the coverage names, CVE-2026-32882, is recorded as an out-of-bounds read that crashes software or leaks memory, not as a code-execution bug. Discourse's own advisory rates the outcome as remote code execution. Both are true, and the gap between them is where the AI's contribution actually sits.

What Hacktron says it found, and when

Hacktron published its write-up, "Hacking OpenAI", on its own site on 13 September 2026. The Wall Street Journal reported it on the evening of Thursday 17 September, according to TechCrunch, which followed on Friday 18 September. The events described happened roughly eight weeks earlier, and Hacktron's own timeline is precise about them:

• 23 July 2026 — the team traces Discourse's HEIF upload path through ImageMagick to libheif and finds the heap overflow.

• 24 July 2026 — Claude Opus 4.8 produces a working code-execution exploit with ASLR, the standard address randomisation defence, disabled.

• 25 July 2026, 06:00 UTC — using a later model, the team confirms reliable local code execution through an image upload with ASLR on.

• 25 July 2026, 08:00–10:00 UTC — the team submits a report through OpenAI's bug bounty programme on Bugcrowd.

• 25 July 2026, 10:00 UTC — the exploit works against the team's own Discourse Cloud instance and then against OpenAI's forum.

• 25 July 2026, 13:30–15:30 UTC — the team uses an OpenAI employee's Codex account to open a harmless pull request in OpenAI's internal monorepo, then stops testing.

• 25 July 2026, 22:49:45 UTC — OpenAI replies confirming the issue is fixed, roughly 14 hours after the initial submission.

• 28 July 2026 — Discourse publishes advisory GHSA-vhm9-85gw-x335 with patch and rebuild guidance.

• 1 September 2026 — OpenAI pays a $6,500 bounty and marks the report resolved.

The dates above are Hacktron's, not a reconstruction. The 13 September publication date on its own post, the 17 September Wall Street Journal report and the 18 September TechCrunch story are a separate, later sequence: the work happened in July, the write-up landed in mid-September.

How an image upload became a server compromise

The chain starts with a mundane feature. Discourse normally checks uploaded images with a library called FastImage, but FastImage does not support HEIF, the container format Apple's devices use for photos. Those files were therefore passed to ImageMagick's command-line tool for conversion, which handed them to libheif to decode. That put a parser directly in front of attacker-controlled files — the exact pattern the xkcd dependency comic has in mind, which Hacktron cites in its references.

Hacktron found that the libheif package installed in Discourse's Docker image was missing security fixes. Discourse's image was built on Debian 12, which installed libheif 1.19.7; Debian 13 still shipped 1.19.8 at the time. The bug itself lives in HeifPixelImage::overlay(), which composites an overlay image onto a base image. According to libheif's own advisory, when an overlay child has a different bit depth for its alpha channel than for its colour channels, the function indexes the alpha plane using the colour channel's stride instead of the alpha plane's. With a 100 by 50 image at 10-bit colour and 8-bit alpha, the advisory calculates the code reads 3,123 bytes past the end of a 7,168-byte buffer.

That gives an attacker leaked heap memory, which is useful for defeating address randomisation — not, on its own, a shell. Getting from the leak to execution is the part that took a model, and it is the part the CVE does not describe. The chain then crossed a trust boundary that Hacktron argues is the real story: OpenAI's forum offers "Sign in with OpenAI" through auth.openai.com, the same single sign-on staff use elsewhere. Control of the forum server meant the researchers could take over the ChatGPT and Codex accounts of forum members who worked at OpenAI, with no interaction from the victims. As Hacktron puts it, "the vulnerability to escalate is not Discourse-specific," and any first- or third-party OpenAI service using that sign-on would have granted the same access.

Established, and inferred

The archive grades this record confidence A, not disputed, severity high, with no real harm recorded. Those fields hold up. But the reporting is a single research team's account, corroborated rather than independently reconstructed, and it is worth separating what is documented from what is asserted.

Established by primary records. CVE-2026-32882 exists, was published on 19 May 2026, affects libheif 1.21.2 and earlier, and was fixed in libheif 1.22.0. The MITRE record scores it 7.1, with attack vector network, low complexity, privileges required none, user interaction required, and impacts of low confidentiality and high availability — a crash or a memory leak. Discourse's advisory GHSA-vhm9-85gw-x335, published 28 July 2026 and credited to hacktronai-research, tracks the same CVE and rates the outcome High at 8.8, with low privileges required, no user interaction, and high impact on all three of confidentiality, integrity and availability. It lists patched versions 2026.7.0, 2026.6.1, 2026.5.2 and 2026.1.6, and states that the latest Docker image includes the patched libheif.

Established by two independent outlets. That the researchers used Claude to find and weaponise the chain, that a forum compromise led to staff account access, that OpenAI fixed it within about 14 hours and paid $6,500, that the proof of access was a single pull request, and that OpenAI says testing the forum itself fell outside its bounty scope — all of this appears in The Hacker News and TechCrunch, both of which quote Hacktron's write-up directly.

Asserted by Hacktron, not independently verified. That code execution on the forum was achieved at all in the manner described — through an autonomous agent loop and a proxied test instance — rests on Hacktron's account and has not been reproduced by a third party; The Hacker News says it has contacted Hacktron with questions about how the forum code execution was achieved and about the scope of the account access, and does not report having received answers. The claim that the same flaw class reached Slack, Meta, GitHub Enterprise and web frameworks is, in The Hacker News's own assessment, "backed unevenly": a Next.js flaw is confirmed in Vercel's advisory and libheif's maintainers confirmed a working exploit for the bug tied to Meta, but the wider claim of code execution across many applications has not been independently confirmed. OpenAI has not published a technical description of the sign-on flaw at all; it confirmed the finding through the fix and the payment rather than by documenting the account takeovers.

Not established at all. How many employee accounts were reachable — The Hacker News says "several", TechCrunch says "multiple", and Hacktron gives no number. Whether the flaw was ever used by anyone else: The Hacker News reports no sign of real-world use and notes the CVE was not on the U.S. government's list of vulnerabilities known to be exploited as of mid-September 2026, while cautioning that the list is not proof either way. And whether organisations that had already patched should still hunt for earlier access — The Hacker News says the sources are silent on that point.

What the models did, and what the humans did

The capability jump is the part Hacktron itself emphasises, and it is documented in its own words rather than inferred. The team first used Claude Opus 4.8, in a build made available to cybersecurity researchers, to inspect the installed libheif package and to build an exploit with ASLR disabled. With ASLR on, it stalled across several sessions. Anthropic released Claude Opus 5 on the evening of 24 July 2026; in a fresh session the new model produced a working ARM64 exploit for a local Mac within about three hours, and by 06:00 the next morning had been ported to the x86-64 configuration Discourse uses.

Claude Opus 5 also shipped with safeguards against writing exploit code for real targets. Hacktron says it worked around them by pointing the model at its own Discourse Cloud instance, proxied through a host named rce.ee/ctf-forum so the target looked like a capture-the-flag exercise, and by running it in an autonomous goal loop. The team is explicit that this was not unattended hacking: "skilled human guidance remained important," it writes, while the amount of work a small team could perform increased dramatically. In the wider HEIF Heist campaign, Hacktron says it used OpenAI's GPT-5.6 Sol for cases where it knew nothing about the target in advance.

The economics are the argument Hacktron wants the reader to take away. Across the broader campaign — tracing the same class of flaw through Slack, Meta, GitHub Enterprise, Ruby on Rails, and the Next.js, Astro and Gatsby frameworks — it says two months of work by three researchers cost under $3,000 in tokens, with each new target taking one or two days to adapt. It also says it is not aware of any company that detected the activity except Shopify, despite thousands of test images being sent and image processors crashing repeatedly.

What changed afterwards

Discourse received the report on a Saturday, replied on Sunday, had a fix by Monday and published its advisory on 28 July, adding sandboxing for image processing as defence in depth. Its advisory warns self-hosters that a web-interface update alone may not replace the underlying library, and that a full rebuild from /var/discourse is required. Debian published a security update for Debian 13's libheif on 8 August 2026, tracked as DSA-6417-1. Upstream, Hacktron points readers at libheif 1.23.4 as the latest security release as of 14 September 2026, and notes that distribution packages may carry backported fixes under an older version number, so the package advisory has to be checked as well as the upstream version.

For OpenAI, the fix landed within about 14 hours of the report on 25 July, and the bounty was paid on 1 September. The company attached a scope clarification to the payment: testing against the Discourse-hosted community.openai.com was explicitly excluded from its bug bounty programme, and the award recognises the OpenAI-side finding rather than the actions against Discourse. That is worth reading carefully. The $6,500 is a payment for the sign-on finding, not for the forum chain, and the forum work that made the chain possible was, by OpenAI's own account, out of scope.

Why the CVE does not match the headline

Coverage of this case tends to compress two different severity ratings into one. The libheif advisory and the CVE describe an out-of-bounds read with a confidentiality impact rated low and an availability impact rated high: crash, or leak memory. The Discourse advisory describes what happened when that read was combined with exploitation work and a second flaw, and rates it 8.8 with full impact across all three categories. Neither is wrong; they answer different questions. The CVE answers "how bad is the library bug?" and the forum advisory answers "how bad is the forum issue?"

The practical consequence is that a reader scanning CVE feeds for a critical remote-code-execution flaw in libheif will not find one here, and might reasonably conclude they are unaffected. Hacktron's own guidance is the opposite: any service that accepts user-supplied HEIC, HEIF or AVIF images and decodes them through an unpatched libheif should be treated as exposed, and the version number alone is not a sufficient check because backports move under stale version strings. The three mitigations it recommends are to update libheif and libde265 through the distribution's security channel or a current upstream release, to disable untrusted HEIF and AVIF decoding where it is not needed or isolate image processing in an ephemeral sandbox, and — the one that generalises beyond image libraries — to limit which services a single sign-on trusts and require a fresh identity check before sensitive actions rather than trusting an existing session.

That last point is the transferable finding. The forum was not the vulnerability; it was the doorway. A public, lower-trust service sharing an identity provider with internal tooling meant that breaking the weakest property in the estate granted the strongest. Nothing in Hacktron's account suggests OpenAI had been careless about the forum itself — Discourse, by the team's own assessment, "is actually not an easy target" — and that is precisely why the case is being cited: the trust boundary, not the bug, is what failed.