Security researchers at Hacktron used Anthropic’s Claude Opus 5 to help uncover and exploit a chain of vulnerabilities that gave them access to OpenAI employee accounts and eventually reached the company’s internal code repository. The research took less than 72 hours from the initial investigation to demonstrating access, highlighting how advanced AI models can accelerate complex security testing.
The work was carried out by three researchers from security firm Hacktron as part of authorized vulnerability research. Rather than exploiting the access for malicious purposes, the team reported the problems to OpenAI and stopped after demonstrating what could be reached.
The attack chain began with OpenAI’s public community forum, which runs on Discourse. The researchers discovered that the forum’s image-processing environment contained a vulnerable version of libheif, a library used to process HEIC and HEIF images.
A specially prepared image could trigger a memory vulnerability when processed by the server. Hacktron’s researchers worked on converting that flaw into a practical way to execute code on the forum infrastructure, but modern protections made the task considerably more difficult.
Claude played an important role at this stage. The researchers initially experimented with Claude Opus 4.8, but the model struggled to produce a working exploit when address space layout randomization, or ASLR, was enabled. After Claude Opus 5 became available in July, the team started a fresh session and said the newer model produced a working approach within hours.
Compromising the forum alone would not normally provide access to OpenAI’s internal development environment. A second weakness involving OpenAI’s authentication system, however, allowed the researchers to turn control of the forum into access to employee accounts.
OpenAI’s community forum offered a “Sign in with OpenAI” option connected to the company’s authentication infrastructure. According to the researchers, the way this login relationship was configured meant that controlling the forum could allow them to take over ChatGPT and Codex sessions belonging to OpenAI employees who had used the service.
The affected employees did not need to click another malicious link or approve a login request. Once the vulnerabilities were combined, the researchers were able to demonstrate access to several staff accounts.
One compromised employee account had Codex connected to OpenAI’s internal GitHub environment. Using that connection, the researchers were able to reach the company’s private repository and create a harmless pull request as proof that the attack chain worked.
Hacktron says it deliberately limited its activity after reaching this point. The researchers did not inspect OpenAI’s source code, merge or deploy changes, or access customer information, and the pull request was intended only to demonstrate the level of access they had obtained.
The potential reach could have been broader because employees can connect external services to ChatGPT and Codex. The researchers said compromised sessions could potentially have provided paths to services such as GitHub, Slack, or email depending on the connections available to an individual employee, although they did not attempt to explore those possibilities.
The research also illustrates how quickly AI-assisted vulnerability work is developing. Building a reliable exploit for a memory corruption vulnerability has traditionally required specialized expertise and considerable manual effort, but advanced models can now assist researchers with analyzing crashes, understanding software behavior, and developing proof-of-concept code.
Human expertise was still required throughout the project. Hacktron did not describe the operation as an autonomous AI system independently discovering and exploiting OpenAI, and the researchers continued directing the investigation and deciding which actions were appropriate.
The underlying libheif vulnerability had already been fixed upstream before Hacktron conducted its research, but the server environment used by the forum still contained an older version of the library. The incident therefore also demonstrates how vulnerabilities can remain reachable when patched components have not yet reached every downstream package or deployed server image.
OpenAI addressed the security issue after receiving Hacktron’s report. According to the researchers, the company confirmed a fix roughly 14 hours later and subsequently awarded the team a $6,500 bug bounty on September 1.