Full Breakdown
Hacktron AI Uses Anthropic’s Claude to Breach OpenAI’s Internal Systems
By Drooid · · How we work
Core Event
A three-person security team from Hacktron AI exploited a heap-buffer overflow in the libheif library used by Discourse, the platform that hosts OpenAI’s community forum. By uploading a crafted HEIC/HEIF image, they achieved remote code execution on the forum server, then leveraged a flaw in OpenAI’s single-sign-on implementation to hijack an employee’s ChatGPT and Codex accounts. Using the compromised Codex credentials, they created a harmless pull request in OpenAI’s private “openai/openai” monorepo, proving access to the company’s internal code repository. The operation was conducted under OpenAI’s Bugcrowd bug-bounty program, which awarded the team $6,500.
Background & Context
The incident follows recent safety concerns at OpenAI, including a July “swarm” of autonomous AI agents that hacked Hugging Face. Hacktron AI framed the breach as part of a broader “HEIF Heist” research campaign that also identified similar libheif vulnerabilities in platforms such as Slack, Meta and Zoom.
Timeline
- July 23 – Hacktron AI discovers a libheif vulnerability in Discourse’s image-processing pipeline.
- July 24 – Anthropic releases Claude Opus 5.
- July 25 – Using Claude Opus 5, the team develops an ARM64 exploit, ports it to x86-64, and gains remote code execution on the forum. OpenAI confirms a fix later that day.
- July 28 – Discourse issues a security advisory, assigns a CVSS score of 8.8 and patches the software.
- September 6 – The libheif project releases version 1.23.4 with additional fixes.
- September 18, 2026 – Outlets publish detailed findings of the breach.
Data & Statistics
- Bounty: $6,500 paid via OpenAI’s bug-bounty program.
- CVSS score: 8.8 for the libheif remote-code-execution vulnerability.
- Exploit development time: Less than 72 hours from discovery to internal repository access.
- AI token cost: Under $3,000 for the two-month “HEIF Heist” campaign.
Official Statements & Responses
Discourse acknowledged the flaw, released the July 28 advisory, and added sandboxing around image processing. Hacktron AI emphasized that they stopped short of examining proprietary source code, limiting their proof-of-concept to a single benign pull request.
Why It Matters
The breach shows how coding agents can accelerate exploitation of complex bugs that previously required weeks of specialist effort. By automating exploit generation, AI models such as Claude Opus 5 reduce the cost and time required for sophisticated attacks, expanding the threat surface for organizations that integrate AI agents with privileged credentials. The incident underscores the need for tighter controls on federated identity, rigorous patch management of third-party dependencies, and segregation of AI-generated credentials from critical infrastructure.
Conflicting Reports & Gaps
OpenAI has not released a detailed public post-mortem; confirmation of the fix remains limited to statements from the company and Discourse. Hacktron AI’s blog provides a technical narrative, but independent verification of the exact scope of accessed code is absent. No other outlets have reported differing figures for the bounty or timeline.
Verbatim Quotes
- “We thank the researchers for contacting us and sharing their findings” — An OpenAI spokesperson
- “Work that once required a well-resourced team and months of effort can now be compressed into days,” — Discourse. Hacktron