Researchers Used Claude to Hack OpenAI's Internal Systems in a Bug-Bounty Chain

On 25 July 2026, three researchers at the security firm Hacktron AI used Anthropic's Claude Opus 5 to connect two security flaws. This allowed them to take control of ChatGPT and Codex accounts belonging to OpenAI employees. They then used one of those accounts to open a pull request, which is a proposed code change, in OpenAI's internal source-code repository. They did not start at a login page or use an API key. Instead, they began by uploading an image to OpenAI's public help forum, community.openai.com, which runs on the open-source forum software Discourse. The second flaw was in OpenAI's own shared sign-in system, not in Discourse. The researchers did not read source code, merge any changes, or access customer data. The archive records no real-world harm. This was security research reported to the companies, not an attack carried out against them. The incident record is dated 18 September 2026, when TechCrunch reported the findings. The case is also listed in the Orca AI Incident Archive, which records sources, severity, confidence levels and whether each incident is disputed.

Two things make this case more important than an ordinary bug-bounty story. First, it happened quickly. Hacktron says it took less than 72 hours to go from first examining the forum to gaining access to an internal repository. The first AI model the team tried could not complete the job. Second, the headline hides an important difference between two security reports. The CVE mentioned in news coverage, CVE-2026-32882, describes an out-of-bounds read, which means software reads memory outside the allowed area. This can crash a program or expose information in memory. It does not, by itself, mean an attacker can run code. Discourse's own security notice rates the final result as remote code execution, meaning an attacker can make a computer run their code. Both descriptions are correct. The difference helps explain what the AI contributed to the attack chain.

What Hacktron says it found, and when

Hacktron published its report, "Hacking OpenAI," on its website on 13 September 2026. According to TechCrunch, The Wall Street Journal reported the findings on the evening of Thursday, 17 September, and TechCrunch published its own report on Friday, 18 September. The events in the report took place about eight weeks earlier. Hacktron gives the following timeline:

• 23 July 2026 — The team follows the way Discourse handles HEIF image uploads through ImageMagick to libheif and discovers a heap overflow, a bug that can cause a program to write beyond its allocated memory area.

• 24 July 2026 — Claude Opus 4.8 creates a working exploit that can run code, but only when ASLR, a defence that randomises memory addresses, is turned off.

• 25 July 2026, 06:00 UTC — Using a newer model, the team confirms that it can reliably run code on the local system by uploading an image, even with ASLR turned on.

• 25 July 2026, 08:00–10:00 UTC — The team submits a report through OpenAI's bug-bounty programme on Bugcrowd.

• 25 July 2026, 10:00 UTC — The exploit works against the team's own Discourse Cloud instance and then against OpenAI's forum.

• 25 July 2026, 13:30–15:30 UTC — The team uses an OpenAI employee's Codex account to open a harmless pull request in OpenAI's internal code repository, which contains many projects. It then stops testing.

• 25 July 2026, 22:49:45 UTC — OpenAI replies that the problem has been fixed, about 14 hours after the first report.

• 28 July 2026 — Discourse publishes security notice GHSA-vhm9-85gw-x335, with instructions for installing the fix and rebuilding affected systems.

• 1 September 2026 — OpenAI pays a $6,500 bounty and marks the report as resolved.

These dates come from Hacktron's own report, not from a later attempt to reconstruct the events. The publication dates are a separate sequence: Hacktron published its report on 13 September, The Wall Street Journal reported it on 17 September, and TechCrunch followed on 18 September. The research happened in July, while the public reports appeared in mid-September.

How an image upload became a server compromise

The chain began with an ordinary feature: uploading an image. Discourse usually checks uploaded images with a library called FastImage. But FastImage cannot handle HEIF, a format used for photos by Apple devices. Discourse therefore sent these files to a command-line tool called ImageMagick to convert them. ImageMagick then passed them to libheif to read the image. This meant that software had to process files supplied by users, which is a common place for security bugs to appear. Hacktron points to an xkcd comic about software dependencies in its references to illustrate this problem.

Hacktron found that the version of libheif installed in Discourse's Docker image was missing security fixes. Discourse's image was based on Debian 12, which included libheif 1.19.7. At the time, Debian 13 still supplied version 1.19.8. The bug is in a function called HeifPixelImage::overlay(), which places one image over another. According to libheif's own security notice, a problem occurs when the overlay image's alpha channel, which controls transparency, uses a different bit depth from its colour channels. The function then uses the colour channel's memory stride, or spacing between rows of data, to find values in the alpha channel. This makes it read beyond the end of the memory buffer. For an image measuring 100 by 50 pixels, with 10-bit colour and an 8-bit alpha channel, the security notice calculates that the code reads 3,123 bytes beyond the end of a 7,168-byte buffer.

This bug can expose data from the computer's heap memory. That information can help an attacker get around address randomisation, but the memory leak alone does not give them a command shell or let them run code. Getting from the leak to code execution was the difficult part, and it required the work Hacktron describes using AI. The chain then crossed a boundary between systems with different levels of trust. OpenAI's forum offers a "Sign in with OpenAI" option through auth.openai.com. OpenAI employees also use this single sign-on system for other services. Once the researchers controlled the forum server, they could take over the ChatGPT and Codex accounts of employees who were forum members, without those employees doing anything. Hacktron says that "the vulnerability to escalate is not Discourse-specific." In other words, any OpenAI service, whether built by OpenAI or provided by another company, that trusted the same sign-in system could have allowed the same kind of access.

What is confirmed, and what is inferred

The archive gives this incident an A confidence grade, marks it as not disputed, rates its severity as high, and records no real-world harm. These ratings are reasonable based on the available evidence. However, the main technical account comes from one research team. Other news outlets have supported parts of the story, but no independent team has reproduced the entire chain. It is important to separate what records confirm from what Hacktron says happened.

Confirmed by primary records. CVE-2026-32882 is a real security issue. It was published on 19 May 2026, affects libheif 1.21.2 and earlier versions, and was fixed in libheif 1.22.0. The MITRE record gives it a score of 7.1. It lists a network attack path, low attack complexity, no required privileges, a need for user interaction, a low impact on confidentiality and a high impact on availability. The effects include a crash or a memory leak. Discourse's security notice GHSA-vhm9-85gw-x335 was published on 28 July 2026 and credits hacktronai-research. It covers the same CVE but rates the resulting issue High, with a score of 8.8. It lists low required privileges, no need for user interaction and high impact on confidentiality, integrity and availability. It identifies patched versions 2026.7.0, 2026.6.1, 2026.5.2 and 2026.1.6, and says the latest Docker image includes the fixed version of libheif.

Reported by two independent news outlets. The Hacker News and TechCrunch both directly quote Hacktron's report. Both describe how the researchers used Claude to find and turn the flaws into an attack, gained access to employee accounts through the forum, and received confirmation that OpenAI had fixed the problem within about 14 hours. Both report that OpenAI paid $6,500 and that the researchers proved access with a single pull request. They also report OpenAI's position that testing the forum itself was outside the scope of its bug-bounty programme.

Claims made by Hacktron that have not been independently verified. The claim that the team achieved code execution on the forum in the way described, using an autonomous AI-agent loop and a test instance accessed through a proxy, relies on Hacktron's account. No third party has reproduced the full process. The Hacker News says it contacted Hacktron to ask how the forum code execution worked and how many accounts could be reached, but it does not report receiving answers. Hacktron also says the same type of bug affected Slack, Meta, GitHub Enterprise and web frameworks. The Hacker News says the evidence for these broader claims varies. Vercel's security notice confirms a Next.js flaw, and libheif's maintainers confirmed a working exploit for the bug connected to Meta. However, the wider claim that this bug class allowed code execution across many applications has not been independently confirmed. OpenAI has not published a technical explanation of its sign-on flaw. It confirmed the finding through the fix and bounty payment rather than by documenting the account takeovers.

What remains unknown. The number of employee accounts that could be reached has not been established. The Hacker News says "several," TechCrunch says "multiple," and Hacktron gives no exact number. It is also unknown whether anyone else ever used the flaw. The Hacker News reports no evidence of real-world exploitation and notes that, as of mid-September 2026, the CVE was not on the U.S. government's list of vulnerabilities known to have been exploited. However, being absent from that list does not prove that nobody used it. Finally, The Hacker News says the available sources do not explain whether organisations that had already installed fixes should investigate possible earlier access.

What the models did, and what the humans did

Hacktron puts the improvement in AI capability at the centre of its account. This is based on what the team itself reported, rather than on an outside guess. The researchers first used Claude Opus 4.8, a version made available to cybersecurity researchers, to examine the installed libheif package and build an exploit with ASLR turned off. When ASLR was turned on, the model failed across several sessions. Anthropic released Claude Opus 5 on the evening of 24 July 2026. In a new session, the newer model produced a working exploit for ARM64 on a local Mac in about three hours. By 06:00 the next morning, the team had adapted it to the x86-64 system used by Discourse.

Claude Opus 5 also came with safeguards designed to stop it from writing exploit code for real targets. Hacktron says it worked around these safeguards by directing the model to its own Discourse Cloud instance, accessed through a proxy called rce.ee/ctf-forum. This made the target look like a capture-the-flag security exercise, where participants solve technical challenges. The team also used a loop in which the AI repeatedly worked towards a goal. Hacktron makes clear that the work was not done without human supervision. It writes that "skilled human guidance remained important," even though AI greatly increased the amount of work a small team could do. For other targets in its wider HEIF Heist campaign, Hacktron says it used OpenAI's GPT-5.6 Sol when it had no prior knowledge of the target.

Hacktron also wants readers to consider the cost of this work. Across the wider campaign, the team says it spent two months examining similar flaws in Slack, Meta, GitHub Enterprise, Ruby on Rails, and the Next.js, Astro and Gatsby frameworks. Three researchers used less than $3,000 worth of AI tokens. Hacktron says adapting the work to each new target took one or two days. It also says it knows of only one company, Shopify, that detected its activity, even though the team sent thousands of test images and repeatedly caused image-processing software to crash.

What changed afterwards

Discourse received the report on a Saturday, replied on Sunday, had a fix by Monday, and published its security notice on 28 July. It also added sandboxing for image processing as an extra layer of protection. A sandbox limits what a program can access if it is compromised. Discourse warns people who run their own servers that updating the web interface alone might not replace the vulnerable underlying library. They must rebuild the system fully from /var/discourse. Debian published a security update for libheif in Debian 13 on 8 August 2026, recorded as DSA-6417-1. Hacktron identifies libheif 1.23.4 as the latest security release as of 14 September 2026. It also warns that Linux distributions may apply fixes to older versions of a package without changing its displayed version number. Users should therefore check the distribution's security notice as well as the upstream version.

OpenAI fixed its issue within about 14 hours of the report on 25 July and paid the bounty on 1 September. Along with the payment, the company clarified what its bug-bounty programme covered. Testing against community.openai.com, which is hosted using Discourse, was explicitly excluded. The award recognised the finding involving OpenAI's own systems, not the actions against Discourse. This distinction matters: the $6,500 payment was for discovering the sign-on flaw, not for exploiting the forum. OpenAI's own explanation says that the forum work that made the full chain possible was outside the programme's scope.

Why the CVE does not match the headline

News reports about this incident often combine two different severity ratings into one. The libheif security notice and the CVE describe a read outside the allowed memory area. They rate the effect on confidentiality as low and the effect on availability as high. This means the bug can expose some memory or crash a program. Discourse's security notice describes the outcome after this bug was combined with exploitation techniques and a second flaw. It gives the result a score of 8.8 and rates the impact as high in all three areas: confidentiality, integrity and availability. These ratings do not contradict each other. They answer different questions. The CVE asks, "How serious is the library bug?" The Discourse notice asks, "How serious is the resulting problem in the forum?"

This difference has practical consequences. Someone searching a CVE database for a critical remote-code-execution flaw in libheif will not find that exact description here and might conclude that their system is safe. Hacktron recommends the opposite approach. Any service that accepts user-supplied HEIC, HEIF or AVIF images and decodes them with an unpatched version of libheif should be treated as potentially exposed. Checking only the version number is not enough because security fixes may be added to older versions without changing their displayed version numbers. Hacktron recommends three main steps. First, update libheif and libde265 through the operating system's security updates or a current upstream release. Second, turn off decoding of untrusted HEIF and AVIF images if the feature is not needed, or isolate image processing in a temporary sandbox. Third, apply a wider security lesson that goes beyond image software: limit which services are trusted by a single sign-on system, and require a fresh identity check before sensitive actions instead of relying only on an existing sign-in session.

That final point is the most widely useful lesson. The forum itself was not the main weakness; it was the doorway into other systems. A public service with a lower level of trust shared an identity provider with internal tools. As a result, breaking the weakest part of the system gave the researchers access to more sensitive services. Hacktron's account does not suggest that OpenAI had been careless about securing the forum. The team itself says Discourse "is actually not an easy target." That is exactly why the incident matters: the failure was in the boundary of trust between systems, not just in the software bug.