Hacktron used Claude to hack OpenAI in under 72 hours
A three-person team at the security startup Hacktron used Anthropic’s Claude to break into OpenAI, and they did it in less than 72 hours. In a disclosure published on September 13, the researchers say they chained two flaws to take over OpenAI employee accounts, then reached the company’s internal code repositories. OpenAI paid them a $6,500 bounty for the finding.
The way in was OpenAI’s community help forum, which runs on Discourse. Hacktron found that the forum’s image pipeline handed HEIC and HEIF uploads to ImageMagick, which in turn called a vulnerable version of the libheif decoder. That bug was a heap buffer overflow, and it gave the team remote code execution through a single crafted image. GitHub later tracked it as CVE-2026-32882, rated 8.8 out of 10.
Code execution on the forum wasn’t the whole attack. The researchers say a separate flaw in OpenAI’s single sign-on turned a forum compromise into access to a user’s ChatGPT and Codex accounts, with no interaction needed. That’s what made a help-forum bug dangerous, because people connect GitHub, Slack and email to those accounts, which means the blast radius reached well beyond a support site. To prove the reach without reading anything sensitive, the team used an employee’s Codex to open a pull request in OpenAI’s internal monorepo, then stopped.
The timing is the part that should worry defenders. Hacktron’s Harsh Jaiswal, Mohan Pedhapati and Rahul Maini had struggled to get a reliable exploit from Claude Opus 4.8. Anthropic released Claude Opus 5 on July 24, and within hours the same problem cracked. A fresh session produced a working ARM64 exploit for a local Mac in about three hours, and by 10 a.m. the next day an autonomous agent had achieved remote code execution against a cloud Discourse instance.
Work that once required a well-resourced team and months of effort can now be compressed into days.
Hacktron, Hacking OpenAI disclosure
Hacktron had permission to push the model this hard. The team was part of Anthropic’s Cyber Verification Program, which Business Insider reports relaxed certain restrictions on Claude for authorized security research. Anthropic describes the program on its Opus 5 page as a way to let verified researchers work around the model’s cyber safeguards. That matters because the same page says Opus 5 is deliberately held back on exploit generation, so the guardrails were doing their job until a vetted team asked for them to be lifted.
The whole thing was cheap. Hacktron says its wider HEIF Heist campaign, which adapted the same libheif attack to Slack, Meta, GitHub Enterprise, Ruby on Rails and Next.js, ran for two months and cost under $3,000 in tokens. Adapting the exploit to each new company took only a day or two. The result was that of all those targets, the team says only Shopify detected the activity, even after image processors crashed repeatedly.
| Detail | Figure |
|---|---|
| Time from discovery to repo access | Under 72 hours |
| Bounty OpenAI paid Hacktron | $6,500 |
| Token cost of the wider campaign | Under $3,000 |
| Discourse CVE severity | 8.8 (High) |
| Targets that detected the attack | 1 (Shopify) |
OpenAI has closed the hole. A spokesperson told Business Insider the company narrowed the permissions on Community sign-in tokens and revoked the affected tokens and sessions. Discourse published its advisory on July 28 and added image-processing sandboxing as a further layer. This lands soon after OpenAI traced its own Hugging Face breach to a batch of unsolvable test tasks, and the two incidents together show how fast AI security has moved to the front of the industry’s worries.
Pedhapati’s framing, given to The Wall Street Journal and quoted by The Verge, is the line to sit with. “I don’t think we are as strong as Chinese threat actors,” he said. “We’re just three guys with Claude and Codex subscriptions.” If that’s true, the next thing to watch isn’t whether frontier labs can be breached, but how quickly the same security overhauls reach the ordinary companies that were never really protected in the first place.
Get the daily rundown
One email each weekday with the AI news that matters, every claim linked to its primary source.
Free, one email each weekday, unsubscribe in one click. We never sell or share your address.
