Security researchers used Anthropic’s Claude models to help turn an image-processing vulnerability into a working attack against a forum used by OpenAI. They then chained that server compromise with a separate single sign-on flaw, taking control of employee ChatGPT accounts and reaching OpenAI’s private GitHub organization.
The intrusion occurred between July 23 and July 25, 2026, according to Hacktron AI’s technical disclosure. The Financial Times reported the incident on September 17, while the Wall Street Journal reported that the researchers found a route into at least three OpenAI employees’ ChatGPT accounts.
OpenAI fixed the vulnerabilities and paid the researchers $6,500 through its bug bounty program. There is no public evidence that customer data was stolen or that the researchers copied OpenAI’s source code. Hacktron says it submitted a harmless pull request to demonstrate access, notified OpenAI, and avoided examining the company’s private code.
The AI-Assisted Hack Chained Two Separate Failures
The intrusion did not depend on one catastrophic bug inside ChatGPT. It combined an exploitable image-processing path in third-party software with an identity configuration problem that dramatically increased the value of the initial access.
The attack unfolded in four broad stages:
- A vulnerable image parser provided the entry point. Hacktron’s automated research identified a memory-safety problem in software used to process HEIF, HEIC, and AVIF images.
- A crafted image enabled remote code execution. The researchers developed an exploit against the image-processing stack used by Discourse, the forum platform involved in the incident.
- An SSO mistake exposed OpenAI employee identities. Once inside the forum environment, Hacktron found that OpenAI’s login configuration provided a route into employee ChatGPT accounts.
- An existing GitHub connection expanded the impact. One compromised account was connected to OpenAI’s internal GitHub organization, allowing the researchers to view repository access and submit a trivial pull request.
Remote code execution, commonly shortened to RCE, gives an attacker the ability to run commands on a targeted server. It is among the most serious classes of software vulnerability because the attacker may be able to access application data, steal credentials, modify files, or use the server as a bridge into connected systems.
Hacktron first tested its exploit against a controlled Discourse Cloud environment that it operated. The team says it reproduced the relevant configuration before using the exploit against the forum connected to OpenAI.
The forum compromise alone would have been significant, but the SSO configuration turned it into a much more serious identity incident. Access moved from a third-party community platform to employee AI accounts and, through one of those accounts, to OpenAI’s source-code infrastructure.
Claude Did More Than Find the Initial Bug
Calling this an autonomous Claude attack would be inaccurate. Human researchers selected the software, directed the investigation, ran multiple model sessions, validated the results, and decided how to demonstrate and report the vulnerabilities.
Claude still performed a substantial share of the technical work.
Hacktron says it was using cybersecurity-focused Claude models to examine public repositories for potentially exploitable software. One model found the image-processing problem while investigating an existing LibRaw vulnerability. The researchers then asked other model sessions to produce and refine a working exploit.
A cyber-focused version of Claude Opus 4.8 reportedly produced an initial exploit that worked when address space layout randomization, or ASLR, was disabled. ASLR makes exploitation more difficult by randomizing where important data and executable code are placed in memory.
The team struggled to make the exploit reliable under a production-like configuration. That changed after Anthropic released Claude Opus 5 on July 24.
According to Hacktron, Opus 5 produced a working ARM64 exploit for a local Mac within three hours. The researchers then instructed it to port the exploit to the x86-64 architecture and jemalloc memory allocator used by the target environment. By the morning of July 25, they had confirmed remote code execution through an image upload.
In a later controlled test, Hacktron told VentureBeat that a fresh Opus 5 session needed only a target URL to reproduce RCE against its own Discourse environment. The process reportedly took about 40 minutes and consumed approximately $9 in model credits.
That follow-up test was not conducted against OpenAI. It was a reconstruction designed to measure how much guidance the model required after the underlying attack path was understood.
The distinction matters. This was not an unsupervised AI model roaming the internet and independently deciding to compromise OpenAI. It was an AI-assisted security operation conducted by skilled researchers. Even with that qualification, the amount of exploit engineering handled by the model is notable. Porting across processor architectures, adapting to a specific allocator, and overcoming exploit mitigations would ordinarily demand considerable specialist time.
OpenAI’s SSO Turned a Forum Bug Into a Code Risk
The image-processing vulnerability opened the door, but OpenAI’s identity setup determined how far the researchers could travel after entering.
Single sign-on is supposed to reduce credential sprawl by allowing one trusted identity provider to authenticate users across several services. The risk is that a mistake in the trust relationship can connect a relatively low-value system, such as an external discussion forum, to accounts with much more valuable permissions.
Hacktron found that OpenAI’s forum configuration allowed the compromised environment to lead into an employee’s ChatGPT account. Further investigation exposed additional employee accounts. The researchers could then access Codex through those identities.
One account had an existing connection to OpenAI’s internal GitHub organization. That connection provided a route to the company’s private monorepo, where Hacktron submitted a redacted, non-functional pull request as proof.
This does not appear to have been a vulnerability in GitHub itself. Nor does the available evidence indicate that OpenAI’s production models, model weights, customer conversations, or central infrastructure were breached. The private repository became reachable because a compromised employee identity already had permission to use the integration.
The researchers say they did not inspect or copy OpenAI’s code beyond what was necessary to confirm access. OpenAI told Forbes that it was not aware of user data being affected and thanked the researchers for reporting the vulnerabilities.
The forum itself was reportedly outside OpenAI’s bug bounty scope. The SSO weakness was eligible, however, and OpenAI paid Hacktron $6,500 after remediating the issue.
That distinction exposes a recurring problem with tightly defined bounty programs. An individual third-party service may be excluded, yet its authentication links can provide a direct path into in-scope systems. Scope boundaries written around domain names do not always match the actual trust boundaries of modern software.
The Vulnerable Dependency Was Only the Entry Point
The incident also illustrates how old vulnerabilities can survive inside newer software through bundled dependencies.
A GitHub security advisory for libheif says versions before 1.20.2 included an unsupported copy of LibRaw containing known vulnerabilities, including CVE-2025-1943. Libheif is used by applications to decode modern image formats, while LibRaw processes raw image data.
Applications do not always use these libraries directly. An image upload may pass through several layers, such as a web application, an image-conversion utility, a format decoder, and bundled supporting libraries. A vulnerability deep in that chain can remain exploitable even when the top-level application appears current.
Discourse subsequently published a security advisory covering RCE through image uploads. The company said its hosted sites had been updated and advised operators of self-hosted installations to install patched releases.
Hacktron’s broader HEIF Heist research examines how image-processing weaknesses can affect several production systems. Media parsers are especially valuable targets because they routinely handle untrusted files and often rely on native code where memory-corruption bugs can become remote execution vulnerabilities.
Frequently Asked Questions
5 questions
1Did Claude autonomously hack OpenAI?
No, Claude did not independently choose or attack OpenAI. Hacktron’s human researchers selected the software, directed multiple Claude sessions, tested the generated exploits, investigated the SSO configuration, and reported the findings. Claude reportedly performed significant vulnerability analysis and exploit-development work, but the operation remained a human-directed, white-hat security investigation.
2
Sources
- Hacktron AI’s technical disclosurehacktron.ai
- Financial Times reported the incidentft.com
- Wall Street Journal reportedwsj.com
- https://x.com/S1r1u5_/status/2100777801335095383x.com
- Anthropic released Claude Opus 5anthropic.com
- Hacktron told VentureBeatventurebeat.com
- Forbes
