Story perspectives

Hackers Hijack OpenAI Employee ChatGPT, Access GitHub

By Drooid · Sep 18, 2026, 2:38 PM UTC · How we work

Summary

Hacktron AI Hijacks Repo

Hacktron AI used Claude Opus 5 to hijack an OpenAI employee’s ChatGPT account and access its private GitHub repository.
The attack began with a heap-buffer overflow in libheif, the image decoder Discourse uses for HEIC uploads on OpenAI’s forum.
Hacktron AI gained full repository access within 72 hours and opened harmless pull request 1186742.
OpenAI paid Hacktron AI $6,500 through Bugcrowd.
Discourse patched the libheif flaw (CVSS 8.8) on July 28.

Summary

OpenAI Boosts Security

OpenAI assigned 25% of its production engineers to security work after the hack.
President Greg Brockman announced a comprehensive security audit that uncovered and patched several serious flaws.
CEO Sam Altman said a 2026 IPO would be “ill-advised” because of ongoing safety challenges.
OpenAI tightened community sign-in token permissions, revoked compromised sessions, and paused non-essential projects.

History

Historical Context

In November-December 2013, Target suffered a supply-chain attack that infected BlackPOS malware on about 1,800 stores, exposing up to 110 million customers and roughly 40 million credit-debit cards. The breach triggered massive lawsuits, a $10 million class-action settlement in 2015 and a $39 million bank settlement in 2016, and spurred industry-wide adoption of bug-bounty and stricter third-party security practices that echo in today’s OpenAI breach response.

1 of 3

Hacktron AI Hijacks Repo

Hacktron AI used Claude Opus 5 to hijack an OpenAI employee’s ChatGPT account and access its private GitHub repository.
The attack began with a heap-buffer overflow in libheif, the image decoder Discourse uses for HEIC uploads on OpenAI’s forum.
Hacktron AI gained full repository access within 72 hours and opened harmless pull request 1186742.
OpenAI paid Hacktron AI $6,500 through Bugcrowd.
Discourse patched the libheif flaw (CVSS 8.8) on July 28.

1 / 3