Hackers used Claude to break into OpenAI's internal code repo

Hacktron AI, a small security research firm, used Anthropic's Claude to gain access to an OpenAI employee's ChatGPT account and reach the company's internal software repository, the team disclosed this week after reporting the incident to OpenAI in July.

The three researchers — Harsh Jaiswal, Mohan Pedhapati, and Rahul Maini — linked two separate security flaws, beginning on OpenAI's public discussion forum and escalating through employee accounts until they had a path into the company's internal GitHub environment. The full path from initial discovery to access took less than 72 hours, according to Hacktron. OpenAI paid the team a $6,500 bounty through its Bugcrowd program.

The entry point was community.openai.com, which runs on the forum software Discourse. Hacktron found that HEIC and HEIF image uploads to Discourse were routed through ImageMagick and decoded using libheif, a library with a heap buffer overflow vulnerability that the researchers determined was exploitable for remote code execution. Initially, the researchers turned to Claude Opus 4.8 to probe the vulnerability and develop an exploit, but address-space layout randomization proved enough of an obstacle that the model could not produce a dependable attack. After Anthropic released Claude Opus 5 on July 24, Hacktron switched models. The newer version produced a working exploit within hours, according to the team.

Remote code execution on the forum was only the first stage. Hacktron says it separately identified a weakness in OpenAI's single sign-on setup under which session tokens issued by the forum remained valid for ChatGPT and Codex. Some of those tokens belonged to OpenAI employees. According to Hacktron, the token-reuse problem originated in OpenAI's identity infrastructure rather than in Discourse itself, which meant the forum was an entry point rather than the true security perimeter — and any other OpenAI SSO-connected service could have played the same role.

To demonstrate the level of access without examining sensitive code, the researchers instructed a compromised employee's Codex account to open a pull request in OpenAI's internal monorepo, a repository named "openai/openai." OpenAI said its review found "limited reads" of private-repository metadata and code, according to the Wall Street Journal . The company said it narrowed permissions on community sign-in tokens and revoked affected tokens and sessions.

Discourse confirmed and patched the image-processing vulnerability. OpenAI said both issues are now resolved.

The Hacktron incident follows a separate episode in which an OpenAI AI agent escaped a testing environment and broke into Hugging Face's infrastructure , prompting the company to commit to closer activity tracking and new internet-access restrictions for models undergoing safety testing. OpenAI president Greg Brockman said this week the company redirected 25% of its production engineers to security work after the two incidents and found additional issues that have since been fixed, according to the Wall Street Journal.

Hacktron said the OpenAI work is part of a broader research campaign, called HEIF Heist, targeting the libheif library across multiple platforms. The three-person team said the entire project cost less than $3,000 in AI model token usage.