A three-person security team used Anthropic's Claude as the shell to open a door into OpenAI's internal code repository, and even left a harmless pull request as a calling card. Running from July 23 to July 28 and finally disclosed in mid-September, this is another data point on AI-assisted attack capability — except this time the target was OpenAI.

Entry point: a HEIF image

The starting point was mundane: the image upload on OpenAI's community forum, community.openai.com. The forum runs on Discourse, which defaults to FastImage for image checks. FastImage doesn't understand HEIF, so HEIF files fall through to the next layer — an ImageMagick + libheif conversion chain. The bug lived there. The upstream libheif maintainer had actually changed the offending code in 2025, but the change wasn't tagged as a security fix and never got a CVE ID, so the version Discourse was running never picked it up. Hacktron's Harsh Jaiswal, Mohan Pedhapati, and Rahul Maini got to exploit a fix that nobody downstream had deployed: upload a crafted HEIF, get remote code execution on the forum's server (theregister.com).

What Claude actually did

Hacktron's writeup has a sharp before-and-after detail: Opus 4.8 produced working exploit code, but only when ASLR (Address Space Layout Randomization) was disabled — and real deployments keep ASLR on, so that path didn't ship. Then on the evening of July 24, Anthropic released Opus 5, and the trio switched models. The report states plainly: "With the new model, working exploit code for a local Mac environment came together in three hours; the remaining work was porting it into Discourse's server environment." After that, they let Claude iterate inside their own test rig until the code worked directly against OpenAI's live forum.

Full timeline: initial contact on July 23, initial entry on July 25, then Codex taking over an employee's GitHub permissions and opening a benign PR — under 72 hours total (xenospectrum.com). The team stopped explicitly and said it didn't read any internal code or sensitive data.

SSO was the second amplifier

Forum RCE alone wasn't enough — what let this actually reach employee accounts was OpenAI's SSO setup. Anyone who logged into community.openai.com with OpenAI credentials had that session state reusable on ChatGPT and Codex. In other words, a forum breach effectively pushed every ChatGPT/Codex account that had ever logged into the forum straight to the edge. XenoSpectrum's breakdown flags this amplification separately: this is not Discourse's fault; it's an OpenAI-side trust boundary between its own services.

Codex was then accessed via an employee's GitHub organization permissions, and Hacktron immediately demonstrated a PR opening in the openai/openai monorepo as proof of access. Discourse published CVE-2026-32882 and security advisory GHSA-vhm9-85gw-x335 on July 28, adding image-processing sandboxing. OpenAI patched its side within 14 hours of the report, revoked the affected tokens, and paid the 6,500 USD bounty on September 1 via Bugcrowd — explicitly noting that "testing against the Discourse-hosted community.openai.com was outside the bounty scope; the award recognizes the OpenAI-side finding, not the Discourse actions."

The model switch changed the exploit difficulty

The cleanest A/B in the report. Same CVE, same researchers, same target — Opus 4.8 produced code that wouldn't run under ASLR; Opus 5 compressed the working exploit time into hours in the same research flow. There's no parallel benchmark here; it's a single case report. But it points at the same old question: when defenders still reason from "what last year's model could do," that time constant keeps getting eaten by Opus 5, by GPT-5, by whatever ships next quarter.

The figure that keeps getting quoted — "under 3,000 USD" in tokens — actually covers the whole "HEIF Heist" project across two months and multiple companies, not just the OpenAI leg, and it excludes labor costs. Reading that as the price tag of "hacking OpenAI" is wrong, but the underlying fact — "two months, three people, a few thousand dollars in tokens, reaching a top AI lab's internal code repo" — is already alarming for defenders.

Three independent defensive checkpoints

Lining up Hacktron's attack path against Discourse's fix advisory, what operators actually need to verify separately isn't "did we patch," but whether each of these three things is independently in place:

  • Entry layer — did the fixed image package actually land in the running image? An upstream patch isn't a deployment.
  • Cross-service authentication — once one service is breached, can the impact propagate to another service's permissions? OpenAI's intended answer here was "no"; the reality was "yes."
  • Development-environment permissions — when an AI agent like Codex is wired into an employee's GitHub organization, what is the actual ceiling on real actions?

Any one of those failing, the same chained attack runs again.

Bottom line

Claude didn't "hack" OpenAI, but it compressed the research-to-exploit time constant from months to days, and the target was the company shipping the most capable models. The 6,500 USD bounty isn't a signal that OpenAI doesn't care — it's a bug-bounty pricing model that hasn't caught up with what the models can do (theregister.com).