Security researchers at Hacktron AI say they used Anthropic’s Claude Opus 5 to automatically build a working exploit against OpenAI’s community forum, then chained it with a sign-in flaw to take over employee ChatGPT and Codex accounts and reach internal code repositories.[1][5][10][15] The test, run under OpenAI’s bug bounty program, ended with the company fixing its side of the vulnerability in roughly 14 hours and paying the team a $6,500 reward, with no indication of malicious exploitation beyond the sanctioned assessment.[5][7][9][15]
The attack path began with a vulnerability in the image-processing pipeline of the Discourse-based forum, where a crafted image upload triggered a heap buffer overflow in the libheif library and allowed remote code execution on the forum server.[5][10][13] Hacktron’s researchers describe prompting Claude to generate exploit code and refinement steps, ultimately producing an automated chain that took them from malicious image to shell access on the community platform in under 72 hours.[9][10][13] Public accounts of the incident so far have not referenced a specific CVE identifier for the image-processing bug, underscoring how latent issues in third-party components can become critical once exposed through a widely used service.[1][9][10]
Once the forum was compromised, a separate weakness in OpenAI’s single sign-on implementation turned what should have been a limited community breach into an avenue for account takeover, according to Hacktron’s technical write-up and subsequent coverage by outlets including SecurityWeek and VentureBeat.[1][7][12][13] Session tokens issued for the forum reportedly carried excessive permissions and remained valid for associated ChatGPT and Codex accounts, including those belonging to OpenAI employees who had authenticated via SSO.[1][5][7][10][12] From at least one employee account, the researchers say they could reach an internal GitHub repository and connected services such as Slack and Outlook, illustrating how identity misconfigurations can greatly expand the blast radius of an otherwise modest web application flaw.[5][10][15]
Hacktron and OpenAI both stress that the exercise was conducted under a white-hat, in-scope bug bounty engagement, and that the team stopped short of downloading proprietary code or attempting to access customer data.[3][5][8][15] OpenAI has stated that it found two issues during the investigation: the forum-side vulnerability in the external Discourse service and a separate problem in its own identity infrastructure that allowed the reuse of forum tokens for full API access.[8][12] Reporting from multiple outlets indicates that there is no evidence of criminal abuse of the same path, and that OpenAI has since locked down the affected integrations.[1][4][9]
According to Hacktron’s timeline, the vulnerabilities were reported through OpenAI’s Bugcrowd program on July 25, 2026, with the company confirming that its portion of the flaw was fixed later that day.[5][7][13] OpenAI ultimately awarded the researchers a $6,500 bounty, acknowledging both the image-processing bug and the SSO misconfiguration while noting that active testing against the third-party Discourse instance was technically outside its bounty scope.[5][7][9] The incident was disclosed publicly in mid-September through a combination of Hacktron’s blog and media reports in outlets such as SecurityWeek, Forbes, and regional technology publications.[1][4][11][15]
For defenders, the OpenAI case is a pointed reminder that security posture must extend beyond core products to community sites, support portals, and other “peripheral” systems wired into single sign-on and internal tooling. Ensuring strict separation between public-facing forums and production environments, enforcing least-privilege scoping on SSO tokens, and keeping third-party libraries like image codecs fully patched can significantly reduce the risk of similar exploit chains, especially as adversaries—and, in this case, ethical hackers—increasingly enlist powerful AI models to accelerate vulnerability discovery and exploitation.[5][9][10][13]
References
- AI-Built Exploit and Sign-In Flaw Opened Path to Internal OpenAI Code
- OpenAI Hacked Using Anthropic’s Claude, Hackers Confirmed It
- Anthropic’s Claude helped cybersecurity researchers breach OpenAI: report
- A Hijacked AI Assistant Login Can Reach Your Connected …
- OpenAI hacked by small team of white hat security researchers …
- Security researchers say they accessed OpenAI employee ChatGPT account using Claude
- Anthropic’s Claude AI Exploited to Penetrate OpenAI Systems …
- OpenAI account takeover flaw exploited with Claude AI
- Researchers use Claude to breach OpenAI’s private codebase
- Hackers used Claude to break into OpenAI’s internal code repo
- Hacktron chained a libheif RCE and an OpenAI SSO flaw to take …
- Security Researchers Hacked Into OpenAI Using Anthropic’s Claude
