Claude-Assisted Exploit Chain Compromises OpenAI Internal Repos

TL;DR

Security researchers at Hacktron AI chained a heap overflow vulnerability in the libheif image library with a single sign-on (SSO) misconfiguration to compromise OpenAI's internal repositories. The attack leveraged Anthropic's Claude Opus 5 to develop a reliable exploit, taking over an employee's ChatGPT account and opening a pull request in OpenAI's internal monorepo. OpenAI patched the issue within 14 hours and paid a $6,500 bounty.

Introduction: A 72-Hour Breach

On July 25, 2026, a three-person research team from Hacktron AI demonstrated a sobering reality: with the help of AI, sophisticated exploit chains are no longer the exclusive domain of well-funded nation-states. Harsh Jaiswal, Mohan Pedhapati, and Rahul Maini compromised OpenAI's internal repositories in less than 72 hours, using a combination of a known-but-unpatched heap overflow and an identity infrastructure flaw.

The attack chain began with a malicious HEIC image uploaded to OpenAI's community forum, powered by Discourse. That image triggered a heap overflow in libheif, a widely-used open-source image decoder. From there, the researchers pivoted through an SSO misconfiguration to seize control of an OpenAI employee's ChatGPT and Codex accounts, ultimately gaining access to the company's internal GitHub organization.

"We're just three guys with Claude and Codex subscriptions," Pedhapati told The Wall Street Journal, underscoring how accessible advanced offensive capabilities have become.

The Technical Chain: From Image to Internal Repo

The exploit chain unfolded in nine distinct stages, each building on the last:

• libheif heap overflow: A heap buffer overflow in libheif 1.19.7, shipped with Debian 12, allowed out-of-bounds read/write primitives during HEIC decoding.
• Missing security backport: The vulnerable code had been fixed upstream in 2025, but the commit was not documented as a security fix and received no CVE, so Debian never backported it.
• ImageMagick integration: Discourse passes HEIF files to ImageMagick for conversion, exposing the libheif parser to attacker-controlled files.
• Discourse image uploads: The forum's profile picture upload feature became the attack vector.
• OpenAI forum compromise: RCE on community.openai.com was achieved.
• SSO misconfiguration: The forum's authentication did not adequately isolate sessions from other OpenAI services.
• ChatGPT/Codex takeover: The researchers accessed an employee's accounts.
• GitHub integration: Codex was connected to OpenAI's GitHub organization.
• Internal repo access: A harmless PR was opened in the openai/openai monorepo.

Claude Opus 5: The Game-Changer

The researchers initially struggled with the exploit. Using Claude Opus 4.8, they spent multiple sessions failing to produce a working exploit against Discourse's default configuration with ASLR enabled. That changed dramatically when Anthropic released Claude Opus 5.

"Opus 4.8 struggled across several sessions to produce a working exploit with ASLR enabled," the team wrote. "Within hours of Opus 5's release, we gave it the same problem and it succeeded." The new model produced a working ARM64 exploit for a local Mac within three hours, then ported it to the x86-64 environment with jemalloc configuration used by Discourse.

The researchers then placed Claude in an autonomous loop against their own Discourse Cloud instance, proxied through a CTF-style domain. By 10:00 a.m., the agent had achieved RCE and demonstrated access by reading /etc/hosts. The same exploit script worked against OpenAI's instance.

The SSO Flaw: A Deeper Problem

While the libheif vulnerability provided the initial foothold, the SSO misconfiguration was the critical escalation vector. The researchers emphasized that this issue was not Discourse-specific but inherent to OpenAI's identity infrastructure.

"If any first-party or third-party OpenAI service using the OpenAI SSO was compromised, it would lead to same access," they wrote. "Discourse was merely one way of proving it." This means the forum compromise could have been replaced by any other vulnerable service integrated with OpenAI's SSO, making the identity flaw the more systemic concern.

Proof of Concept: A Harmless PR

To demonstrate impact without accessing sensitive data, the researchers used the compromised employee's Codex account to open a pull request in OpenAI's internal monorepo. They then ceased all testing at approximately 15:30 UTC on July 25.

OpenAI acknowledged the report roughly 14 hours after the initial submission, confirmed the fix, and later paid a $6,500 bounty. Notably, OpenAI clarified that the award recognized the SSO finding, as testing against the Discourse-hosted forum was explicitly excluded from their bug bounty program.

Discourse, for its part, responded quickly: a fix was ready by Monday, with image-processing sandboxing added as defense in depth. The advisory GHSA-vhm9-85gw-x335 was published with patch and rebuild guidance.

Broader Implications: The HEIF Heist

This attack is part of a larger research project called HEIF Heist, which traced libheif vulnerabilities across Slack, Meta, GitHub Enterprise, Ruby on Rails, and JavaScript frameworks like Next.js, Astro, and Gatsby. The researchers warn that any application accepting .heic/.heif/.avif images is likely affected.

The economics of the attack are striking: the entire two-month research project cost less than $3,000 in AI tokens. Adapting the exploit to each new company typically took one or two days, and the researchers noted that no company detected their activity except Shopify, even after thousands of images crashed their image processors.

"This was not completely autonomous hacking, and skilled human guidance remained important," the team wrote, "but the amount of work a small team could perform increased dramatically."

Why This Matters: The Erosion of Security Through Obscurity

The researchers argue that software has long benefited from "security through complexity"—public vulnerabilities were still hard to exploit without rare expertise and significant time. AI is removing that barrier.

"Work that once required a well-resourced team and months of effort can now be compressed into days," they wrote. This shift demands that security assumptions catch up with attacker capabilities. Threat models must account for the economics of AI-assisted exploitation, where a small team with $3,000 in compute can target frontier AI companies.

Patches and Recommendations

Organizations using libheif should take immediate action:

• Update upstream: Install the latest security-patched libheif and libde265 packages. As of September 14, 2026, the latest upstream security release is v1.23.4.
• Check distribution backports: Debian has published DSA-6417-1 for libheif; ensure your package includes the security backport.
• Rebuild Discourse: Self-hosted Discourse installations must run git pull followed by ./launcher rebuild app—a web-interface update alone may not replace the underlying vulnerable image.
• Defense in depth: Disable untrusted HEIF/AVIF decoding where not needed, or isolate image-processing pipelines in hardened, ephemeral sandboxes. ImageMagick's security policy can restrict accepted formats.

Conclusion

The Hacktron research demonstrates that AI is fundamentally changing the offensive security landscape. What once required a nation-state's resources is now achievable by three researchers with AI subscriptions and a few thousand dollars. For companies building the next generation of AI, this is a wake-up call: foundational security must evolve as rapidly as the capabilities of the tools they create.

As the researchers noted, "The company building AGI had firewall standards resembling those made by an outsourced firm." The gap between AI capabilities and security practices is now the most critical vulnerability of all.