Security startup Hacktron said a three-person team moved from a user-uploaded image on an OpenAI forum to access inside OpenAI’s main internal code repository in less than 72 hours, then submitted a harmless pull request as proof. OpenAI later paid a $6,500 bounty.
In a blog post titled Hacking OpenAI, Hacktron said the attack chain combined an older libheif bug that had not been fully addressed downstream, a misconfigured single sign-on setup at OpenAI, and exploit code produced with help from Claude Opus 5. The result, it said, was access to an OpenAI employee account and the company’s internal repository.
The team said it did not access sensitive code. Instead, it used the compromised account to open a harmless pull request as verification and then stopped.
The entry point was an image upload on OpenAI’s forum
The group was led by Harsh Jaiswal and included Mohan Pedhapati and Rahul Maini. On July 23, they focused on the image upload flow at community.openai.com.
The forum runs on Discourse. When users upload HEIC or HEIF images, the system passes them through ImageMagick, which in turn relies on the libheif decoder.
Hacktron said libheif contained a heap buffer overflow. During image parsing, data written past the allocated boundary could overwrite adjacent memory, creating a path for attacker-controlled instructions.
According to the team, the flaw had been fixed upstream the year before, but it was not labeled as a security issue and did not receive a CVE identifier. Hacktron said that likely helps explain why Debian 12 and Debian 13 did not patch it in time. Both were still using a vulnerable libheif version, and Debian 13 did not receive a security update until Aug. 8.
Claude Opus 5 changed the outcome
On July 24, the team first tried using Claude Opus 4.8 to write exploit code. It only worked after disabling a memory protection layer, and repeated attempts failed when default protections remained in place.
That changed later the same day when Anthropic released Claude Opus 5. Hacktron said it opened a new session and produced an exploit capable of breaking into the Discourse environment within three hours. By early morning on July 25, the team said it had confirmed remote code execution, or RCE, meaning it could make the target server run chosen code over the network without touching the target device directly.
Hacktron also said Opus at one point refused to write exploit code for a remote host. The team said it described its own test host as a capture-the-flag target, after which the model continued.
From forum admin access to an employee account and GitHub
On the morning of July 25, the group said it obtained RCE and administrator privileges in the production forum environment and reported the issue to OpenAI right away. Later that afternoon, it took over an employee account.
That account’s Codex was connected to OpenAI’s GitHub organization, Hacktron said. Using that access, the team opened PR #1186742 in the internal main repository, openai/openai, as proof, then stopped. Around 14 hours later, OpenAI confirmed that remediation was complete.
Where the bounty applied, and where Hacktron says the real issue sat
OpenAI paid $6,500 after the fact, but said in its closure note that the Discourse-hosted forum was outside the scope of its bug bounty program. The payment covered only the finding on the OpenAI side.
Hacktron said the deeper problem was OpenAI’s SSO configuration. If multiple services rely on the same login framework and that mechanism is set up incorrectly, one compromised service can become a shared backdoor into the rest. In its telling, Discourse was only one route.
The team said Discourse responded quickly: it received the report on Saturday, replied on Sunday, had a patch ready on Monday, began isolating ImageMagick processing, and later published a security advisory.
A broader claim about AI-assisted offensive work
Hacktron said this incident was one stop in its "HEIF Heist" project. Over two months, the three-person team said it spent less than $3,000 on AI usage and, on average, broke into a new target every one to two days. It named Slack, Meta, GitHub Enterprise, Ruby on Rails, and Next.js among the targets.
The team said it sent thousands of images that repeatedly crashed image-processing pipelines. Aside from Shopify, no company noticed the behavior.
Hacktron said this was not a fully autonomous hacking operation and that experienced human guidance still mattered. Even so, it argued that AI had sharply expanded what a small team could do. It also said there was another noticeable step up from Claude Opus 5 to OpenAI’s own GPT-5.6 Sol, and that the latter could complete an attack even without prior knowledge of the target system.
Its conclusion on software security assumptions
Hacktron argued that software has long benefited from what it described as security through complexity. Even when code and bug details are public, turning them into reliable exploitation methods has required specialized skill and time, which has protected many ordinary companies.
That barrier is eroding, the team wrote in its blog. "Security assumptions must keep pace with attacker capabilities. A practical threat model should factor in the economic cost of exploitation today."