Skip to content
NewsIncident

Hacktron Researchers Used Claude Opus 5 to Exploit a Discourse Image Flaw and Access OpenAI Internal Repositories

· by Pondero Newsdesk

The short version

Three Hacktron AI security researchers chained a heap buffer overflow in the libheif decoder with an OpenAI SSO flaw to access employee accounts and an internal monorepo on July 25, 2026. Claude Opus 5 cracked an exploit that Opus 4.8 could not.

Hacktron Researchers Used Claude Opus 5 to Exploit a Discourse Image Flaw and Access OpenAI Internal Repositories

Three Hacktron AI security researchers chained two vulnerabilities to access multiple OpenAI employee accounts, a connected GitHub integration, and an internal OpenAI code repository on July 25, 2026. The technique involved a heap buffer overflow in the libheif image decoder, reachable through OpenAI's community forum, plus a second SSO flaw. The researchers disclosed to OpenAI the same day; OpenAI patched within 14 hours and paid a $6,500 bug bounty.

The exploit chain

The entry point was OpenAI's community forum, which runs on Discourse. When users uploaded HEIF or HEIC image files (the format iPhones produce by default), Discourse passed them through ImageMagick, which in turn called the libheif library to decode them before converting to JPEG. That libheif version contained a heap buffer overflow. Its developers had already issued a fix months earlier, but the patch was never assigned a CVE tracking number. Without a CVE, the fix did not propagate through standard vulnerability-management tooling, and the Discourse installation at community.openai.com still ran the vulnerable version, per the Hacktron blog.

Harsh Jaiswal, Mohan Pedhapati, and Rahul Maini began exploit development using a cybersecurity-researcher version of Claude Opus 4.8, per TechCrunch. Opus 4.8 failed across multiple sessions to produce a working remote code execution script against Discourse's default configuration. When Anthropic released Claude Opus 5, the researchers gave it the same problem. Within hours it produced a working exploit.

With remote code execution on the Discourse server, the team exploited a second flaw: an SSO misconfiguration in OpenAI's identity infrastructure that allowed someone controlling the forum server to take over linked OpenAI accounts. The researchers accessed multiple employee ChatGPT and Codex accounts. To demonstrate the extent of access without reading internal code, they used an employee's Codex connection to open pull request #1186742 in OpenAI's internal monorepo, then stopped all testing at 15:30 UTC, per the Hacktron blog.

Discourse published security advisory GHSA-vhm9-85gw-x335 and added image-processing sandboxing. OpenAI noted that community.openai.com was excluded from its bug bounty scope; the $6,500 award covered the "OpenAI-side finding" (the SSO and account-access chain), not the Discourse compromise itself, per Hacktron.

Why it matters

The Opus 4.8-to-Opus 5 capability jump is now documented in a real-world, disclosed exploit chain against a major AI company. Claude Mythos 5, the model released after Opus 5, was later subject to temporary US export restrictions over its offensive security capabilities. The Hacktron disclosure places Opus 5 between those two points: capable enough to convert a real memory-corruption bug into a working exploit, and available on a standard API subscription.

The attack also exposed two structural weaknesses that security teams can address directly. The libheif patch existed but carried no CVE, so it fell outside the tracking mechanism most enterprises rely on to drive remediation. The SSO architecture then let a compromised third-party forum (explicitly outside OpenAI's bug bounty scope) become the entry point into internal infrastructure.

Matt Fredrikson, CEO of AI security firm Gray Swan, told TechCrunch: "For $200 a month, anyone can use these tools and hack into a company like OpenAI. If it can happen to them, it could happen to anyone."

The Hacktron team extended the same libheif research across Slack, Meta, GitHub Enterprise, and several Node.js frameworks, under a project called HEIF Heist. The broader multi-target campaign cost less than $3,000 in tokens over two months with three researchers, per the Hacktron blog.

What to watch next

Hacktron indicated it plans additional HEIF Heist disclosures as affected vendors patch. Self-hosted Discourse administrators running pre-July 27 versions should rebuild their installations now; a web-interface update alone does not replace the underlying libheif dependency. The broader question for the industry is whether AI models capable of writing functional memory-corruption exploits require usage controls before they reach the capability level that triggered the Mythos 5 restrictions.

Sources