OpenAI’s $6,500 Claude breach was a HEIF parser patch gap

A three-person security research team used Anthropic’s Claude Opus models to chain an image-upload remote-code-execution flaw with an OpenAI account takeover issue, reaching an employee’s ChatGPT and Codex account in less than 72 hours. The researchers stopped after directing Codex to open a harmless pull request in OpenAI’s internal GitHub monorepo, rather than reading code or extracting data.

OpenAI says it fixed the issues in roughly 14 hours, narrowed Community sign-in token permissions, and revoked affected tokens and sessions. The company paid Hacktron researchers Harsh Jaiswal, Mohan Pedhapati, and Rahul Maini $6,500 through its bug-bounty program.

The incident was not a direct compromise of OpenAI’s core infrastructure. Its entry point was community.openai.com, an OpenAI forum hosted on the third-party Discourse platform. The chain linked a public image upload to an employee identity and then a connected developer account through federation tokens and connected applications with broad authority.

“We thank the researchers for contacting us and sharing their findings. We narrowed the permissions on Community sign-in tokens and revoked affected tokens and sessions.”

How a HEIF upload became server access

The initial bug sat in Discourse’s image-processing path. In the affected configuration, FastImage did not support HEIF files, so a HEIF or HEIC upload was passed through ImageMagick and then to the libheif decoder before conversion to another image format. That fallback exposed the underlying image parser to attacker-controlled content.

Hacktron identified a heap buffer overflow in libheif. A specially constructed image could cause the library to mishandle image positioning, creating a route to execute code on the server processing the upload. Claude Opus 4.8, a version reportedly made available to qualified cybersecurity researchers, helped identify the defect but did not produce an exploit that worked against Discourse’s default configuration. Hacktron says the result changed when Claude Opus 5 became available: the same task produced a working exploit script, enabling remote code execution on OpenAI’s Discourse instance.

Recommended reading

Hacktron’s OpenAI breach shows an SSO flaw, not just AI exploits

Sergey Kuznetsov • Sep 18, 2026 • 10 min read

Remote code execution on a forum host was only the first half of the chain. Hacktron reported that a second weakness let it take over ChatGPT and Codex accounts belonging to forum users, including OpenAI employees. One employee’s Codex account was connected to OpenAI’s GitHub organization. Rather than access the internal monorepo itself, the researchers prompted that account to submit a pull request, then ended testing.

Claude did not independently conduct the intrusion. Hacktron said human guidance remained important while describing a sharp increase in what a small team could do. The researchers characterized the practical effect as compressing work formerly associated with a well-resourced team and months of effort into days.

“Work that once required a well-resourced team and months of effort can now be compressed into days.”

The patching failure was upstream and downstream

One account of the incident said the libheif fix had existed for months but was not formally tracked with a CVE, helping explain why Discourse still ran an exposed version. The official Discourse advisory now identifies the upstream issue as CVE-2026-32882, so the flaw is no longer an unnumbered parser bug in the public record.

The advisory lists multiple Discourse release tracks as affected and provides four patched releases. The current Docker image contains the patched libheif; supported Discourse core releases also add image-processing sandboxing where the host kernel supports it. That sandbox is defense in depth, not a substitute for bringing the vulnerable decoder up to date.

Administrators running Discourse are instructed to update through ./launcher rebuild app. The Discourse security advisory also says its additional sandboxing depends on kernel support, so it is not a complete mitigation on its own.

OpenAI stressed that the bounty did not reward testing against Discourse itself. The company said the Discourse-hosted community forum was explicitly excluded from its bug-bounty program and that the payment recognized the OpenAI-side finding. OpenAI treated the account and token boundary, rather than the third-party server exploit, as the reportable impact it compensated.

What was exposed, and what was not demonstrated

Hacktron said the theoretical reach from a compromised ChatGPT or Codex account could include connected GitHub, Slack, Outlook, and email services. That is a statement about connected-service scope, not proof that the researchers entered every one of those services. The team says it did not retrieve sensitive information or view internal monorepo code.

One report described the monorepo as containing OpenAI’s “algorithmic secrets,” based on unnamed sources. The researchers' own reported proof was narrower: a pull request created through the compromised employee Codex account. The incident establishes that an account with a GitHub connection could be commandeered; it does not establish that Hacktron read, copied, or modified OpenAI source code.

Hacktron said the broader “HEIF Heist” work could be adapted to targets including Slack, Meta, GitHub Enterprise, Rails, Next.js, and ImageMagick in one or two days, at a token cost below $3,000. It said Shopify was the only target known to have detected the work. Those claims describe the researchers' stated testing results, not independently published compromise evidence for each named organization.

“I don’t think we are as strong as Chinese threat actors… We’re just three guys with Claude and Codex subscriptions.”

This is separate from the Hugging Face intrusion

The OpenAI forum compromise arrived after the July 2026 intrusion at Hugging Face, but the two events should not be conflated. Hugging Face’s incident disclosure says an autonomous agent framework ran a multi-stage attack against its dataset-processing pipeline, exploiting a remote-code dataset loader and template injection in a dataset configuration. It says the attacker escalated to node-level access, harvested cloud and cluster credentials, and moved laterally across internal clusters.

Hugging Face recorded more than 17,000 attacker events and said the campaign involved many thousands of actions across short-lived sandboxes with self-migrating command-and-control on public services. It detected the intrusion with AI-assisted telemetry triage, then used its own locally run instance of Z.ai’s open-weight GLM-5.2 to analyze attacker logs. Hosted frontier models blocked some forensic prompts because the inputs contained real exploit payloads and command-and-control artifacts.

That primary disclosure does not identify OpenAI agents as the attacker, despite a characterization in one report that OpenAI agents had escaped a testing environment. Hugging Face says the model used by the attackers remains unknown; it could have been a jailbroken hosted model or an unrestricted open-weight model. It reported no evidence of tampering with public models, datasets, Spaces, container images, or published packages, while continuing to assess whether partner or customer data was affected.

We previously covered cases in which Claude Code helped expose hidden HP BIOS settings, escaped a sandbox in a capture-the-flag exercise, and competing agents disabled processes during a four-hour coding test. This OpenAI incident differed from those controlled or researcher-directed demonstrations: it involved a patched third-party image parser, real account takeover, and a production service connected to employee developer workflows.

Opus 5's role and the missing benchmark

Hacktron gave the newer model a problem Opus 4.8 had struggled to solve and obtained a working remote-code-execution exploit within hours—one report puts the turnaround at about three hours. The public record contains no reproducible evaluation, prompt set, exploit code, or independent benchmark for the before-and-after result.

The reports also differ on Anthropic’s restricted cyber-capability model. One calls it Claude Mythos and says it was not used; another refers to Mythos 5. Both agree that the model used for this exploit was Opus 5, not that restricted system. Anthropic declined to comment on the intrusion.

Separately, Anthropic said 26% of its research and development work was “led by” Claude, up from 1% in March 2026. Under its definition, the model completes the majority of tasks from human instructions under supervision. Anthropic also said its models were not fully autonomous for any of the research it studied, and that humans collaborated with the system on 90% of tasks. Those figures frame the company’s own development workflow; they do not measure or validate Hacktron’s exploit performance.

A token and identity problem, not just an AI story

The incident indicates that a public community forum provided a bridge to durable identity artifacts that could authenticate users into ChatGPT, Codex, and potentially connected third-party services. OpenAI’s stated remediation—tightening Community sign-in tokens and revoking affected sessions—addresses that bridge. Discourse’s patched decoder and optional processing sandbox address the initial foothold.

Both controls were required. Patching libheif without limiting what a compromised forum session could inherit leaves too much downstream impact; reducing token scope without fixing unauthenticated image processing leaves an exposed server in place. It remains unknown how broadly organizations using affected Discourse builds had deployed the vulnerable parser and whether their forum identities can reach higher-value services.

For OpenAI, the demonstrated impact ended at a harmless pull request. The proof required neither access to a supposedly restricted cyber model nor a large offensive team—just a public HEIF upload path, an account-linking weakness, and a few days of guided work.