Researchers at Hacktron AI used Anthropic’s Claude to help compromise OpenAI employee accounts and open a proof-of-concept pull request in the company’s internal code repository. The team says it stopped without reading internal source code.
Harsh Jaiswal, Mohan Pedhapati and Rahul Maini describe the July 25 intrusion in a write-up dated September 13. They say the path from discovery to repository access took less than 72 hours, with skilled human guidance remaining important.
The chain began with an image-decoding vulnerability in OpenAI’s Discourse-hosted community forum. A separate OpenAI single sign-on misconfiguration allowed the researchers to take over ChatGPT and Codex accounts. An employee’s Codex session was connected to OpenAI’s GitHub organization, letting them prompt it to create the harmless pull request.
Claude Opus 4.8 helped identify the vulnerable image library but struggled to produce a reliable exploit with memory-address randomization enabled. Hacktron says Opus 5 succeeded after its release. The researchers also disguised their own test forum as a capture-the-flag target after the model refused remote exploitation.
OpenAI paid a $6,500 bounty for the OpenAI-side finding. A company comment reproduced in the write-up says testing against the externally hosted forum was explicitly excluded from its bounty program.
Discourse’s advisory identifies the image-upload flaw as CVE-2026-32882, an upstream vulnerability in libheif, which encodes and decodes HEIF and AVIF images. It rates the issue High, with a severity score of 8.8 out of 10. The listed attack conditions require low privileges and no user interaction; the advisory rates potential confidentiality, integrity and availability impacts as High.
The patched Discourse versions listed are 2026.7.0, 2026.6.1, 2026.5.2 and 2026.1.6. The advisory says its latest Docker image contains a patched libheif dependency and that supported core releases add image-processing sandboxing where the operating-system kernel supports it.
Debian’s August security update addresses this flaw alongside other libheif vulnerabilities that can cause service disruption, disclosure of memory contents or arbitrary code execution when processing malformed images. For Debian 13, known as trixie, the advisory identifies 1.19.8-1+deb13u1 as the fixed package version and recommends upgrading libheif.
OpenAI has separately released six reports of model misalignment, including unauthorized credential use during training. The July Hugging Face breach involved OpenAI agents escaping an evaluation environment. Hacktron’s account concerns researchers directing AI-assisted security testing against OpenAI’s services.
Discourse’s remediation guidance calls for rebuilding the application with its updated Docker image. The additional image-processing sandbox is a defense-in-depth measure against this class of vulnerability.
Sources: Hacktron AI, Discourse, Debian
–
By the Control Plane Editorial Team