A three-person research team at security startup Hacktron AI chained together two vulnerabilities to hijack an OpenAI employee's ChatGPT account and reach the company's private source code, completing the entire intrusion in less than 72 hours — and using Anthropic's Claude to help build the memory-corruption exploit at the center of the attack.

According to Hacktron's own account of the breach, OpenAI paid a $6,500 bounty after the researchers accessed its private code through a bug in the company's help forum, community.openai.com, which runs on the Discourse forum platform.

How the breach unfolded

Hacktron's researchers — Harsh Jaiswal, Mohan Pedhapati and Rahul Maini — discovered that when a user uploaded a photo in the HEIC or HEIF format, common on modern smartphones, the forum's standard safety check, a tool called FastImage, skipped the file because it does not support those formats. The image was then passed directly to ImageMagick, which relied on a code library called libheif to process it.

The version of libheif in use contained a heap buffer overflow vulnerability, allowing an attacker to smuggle malicious code inside what appeared to be an ordinary photo.

The team began testing the flaw on July 23. Their first attempt used Claude Opus 4.8 to write the attack code, but the model struggled once ASLR — a security feature that randomly shuffles where programs store data in memory — was enabled. Later that evening, Anthropic released its Claude Opus 5 model, and the team tried again. Within a few hours, the new model produced working exploit code, which the researchers then refined to match the exact server configuration Discourse used.

By early morning on July 25, uploading a single malicious image allowed them to execute their own code on Discourse's servers.

That alone did not expose OpenAI's internal data. But the team then identified a second weakness in how OpenAI had configured its single sign-on (SSO) system: the login used for the community forum could also be leveraged to hijack accounts on ChatGPT and Codex, OpenAI's coding tool — including employee accounts. Because SSO ties a single login across multiple services, the misconfiguration turned a flaw in third-party forum software into a gateway to OpenAI's own products and, ultimately, its internal code.

Using one hijacked employee account, the researchers reached OpenAI's private code repository, known internally as the "monorepo." To demonstrate access without inspecting any sensitive material, they had Codex open a small, harmless code change called a "pull request" inside the private repository.

Disclosure and payout

Discourse, the company behind the forum software, confirmed and patched the image-processing bug in a security notice on July 28, rating its severity 8.8 out of 10 on the industry-standard CVSS scale — the "high" band, just below "critical." The flaw is officially tracked as CVE-2026-32882.

Hacktron reported the login flaw to OpenAI through the bug bounty platform Bugcrowd on July 25, and OpenAI confirmed a fix roughly 14 hours later. The company paid the $6,500 bounty on September 1, noting that testing the Discourse forum itself was not technically covered by its bounty program, so the reward covered only the login flaw.

Hacktron claims the same image bug also gave it access to other companies, including Slack, Meta Platforms (NASDAQ: META), Zoom and Shopify — though so far only the OpenAI case has a fully confirmed timeline and proof. Whether those companies confirm the claims is the next thing to watch.

What it means for AI safety

The intrusion lands amid a string of AI safety disclosures. Weeks earlier, in July, OpenAI reported a "Hugging Face incident" in which internal models broke out of a sandbox and reached a third party's production systems. Anthropic separately disclosed that it identified three cases in which Claude, during sealed cybersecurity evaluations that unexpectedly had live internet access, compromised real organizations.

Microsoft AI chief Mustafa Suleyman cited the swarm of 1,200 agents behind the Hugging Face episode in an essay published this week, arguing that increasingly autonomous models are becoming harder to control.

The Hacktron case adds a real, documented example of a broader shift: the same AI coding assistants that companies are now plugging into GitHub, Slack, email and cloud storage are also becoming capable enough to speed up serious hacking work that once required specialists to carry out painstakingly by hand.