From Hacktron AI · · 4m
How AI helped hackers breach OpenAI
Researchers used Claude to find and exploit vulnerabilities in OpenAI's forum, gaining access to employee accounts and internal repositories in 72 hours.
In brief
Researchers used Claude to find and exploit vulnerabilities in OpenAI's forum, gaining access to employee accounts and internal repositories in 72 hours. AI models are making sophisticated exploits dramatically faster and cheaper to develop, forcing companies to rethink security assumptions built on the scarcity of…
Hackers breached OpenAI in 72 hours
On July 25, 2026, Hacktron chained two critical vulnerabilities to compromise multiple OpenAI employee ChatGPT accounts and access internal repositories.
They proved access without stealing data
To demonstrate they had gained access without learning sensitive information, they used an employee's Codex to open a pull request in OpenAI's internal monorepo.
The attack chain started with a forum
OpenAI's help forum at community.openai.com allowed users to sign in with OpenAI credentials, creating a path to compromise ChatGPT and Codex accounts.
Connected services multiplied the damage
Because people connect GitHub, Slack, and email to ChatGPT and Codex, compromising these accounts gave access to a huge range of services and data.
Discourse used a vulnerable image library
Discourse's forum passed HEIC and HEIF image files to ImageMagick for conversion, which exposed the underlying libheif parser directly to attacker-controlled files.
A missed security backport created the hole
Debian 12 shipped libheif version 1.19.7 with a heap buffer overflow vulnerability that had been fixed upstream but never backported as a security update.
Claude Opus 4.8 found the vulnerability
Hacktron started an Opus 4.8 session with the Discourse Docker image and asked it to inspect libheif for security issues. It found the unbackported security fixes.
Opus 5 cracked the exploit in hours
When Claude Opus 5 released on July 24, Hacktron gave it the same problem. Within 3 hours it produced a working ARM64 exploit, then ported it to the x86-64 environment.
AI went autonomous against the target
Hacktron placed Claude in an autonomous goal loop against their own Discourse instance. By 10 a.m. on July 25, the agent had achieved remote code execution and read system files.
They took over an employee account
Using the exploit, Hacktron gained remote code execution on OpenAI's Discourse instance and took over an employee account whose Codex was connected to GitHub.
Responsible disclosure worked fast
Hacktron reported to OpenAI on July 25 at 8 a.m. OpenAI confirmed the fix by 10:49 p.m. the same day, roughly 14 hours after submission.
Discourse patched even faster
Discourse received the report on Saturday, replied on Sunday, and had a fix ready by Monday. They also added image-processing sandboxing as defense in depth.
OpenAI paid a six thousand five hundred dollar bounty
OpenAI awarded Hacktron six thousand five hundred dollars for the OpenAI-side finding, though testing against Discourse was explicitly excluded from the bug bounty program.
This was part of a larger campaign
Hacktron expanded the research into HEIF Heist, a two-month investigation tracing libheif across Slack, Meta, GitHub Enterprise, and frameworks like Next.js and Gatsby.
The whole campaign cost under three thousand dollars
Three researchers spent two months finding vulnerabilities across multiple companies, spending less than three thousand dollars in AI tokens total. Adapting exploits usually took one or two days.
AI is democratizing sophisticated attacks
Work that once required a well-resourced team and months of effort can now be compressed into days. AI is turning scarce hacking expertise into compute, removing a practical security boundary.
Companies need new threat models
Security assumptions built on the scarcity of expertise no longer hold. Realistic threat models must account for the economics of exploitation today, not outdated assumptions about who can attack.
Update libheif immediately
Any deployment lacking the latest upstream security patches is potentially vulnerable. Update to libheif version 1.23.4 or later through your distribution's security channel.
Sandbox image processing as defense
Disable untrusted HEIF and AVIF decoding where not needed, or isolate image-processing pipelines inside hardened, ephemeral sandboxes. Use ImageMagick's security policy to restrict formats.
The big picture
AI models are making sophisticated exploits dramatically faster and cheaper to develop, forcing companies to rethink security assumptions built on the scarcity of hacking expertise.
