A three-person research team at security startup Hacktron AI chained two vulnerabilities to breach OpenAI's systems, accessing the company's private code repository within 72 hours. OpenAI paid a $6,500 bounty for the discovery.
How the Breach Occurred
Researchers Harsh Jaiswal, Mohan Pedhapati, and Rahul Maini identified a flaw in OpenAI's help forum, community.openai.com, which runs on Discourse software. The vulnerability stemmed from improper handling of image uploads in HEIC and HEIF formats.
When users uploaded photos in these formats, the forum's safety check tool called FastImage skipped validation because it does not support those formats. The images were instead passed directly to ImageMagick, which used a code library called libheif containing a heap buffer overflow bug. This allowed attackers to inject malicious code disguised as a photo.
Role of Claude in the Attack
On July 23, the team began testing the vulnerability. Initial attempts to generate attack code using Claude Opus 4.8 failed when the ASLR security feature was enabled, which randomizes memory locations to prevent attacks. When Anthropic released Claude Opus 5 later that evening, the team used the new model to generate working exploit code within hours. Claude then adapted the code to match Discourse's specific system configuration.
By early morning on July 25, uploading a malicious image enabled the team to execute code on Discourse's servers.
Secondary Vulnerability
The image upload flaw alone did not provide access to OpenAI's sensitive information. The researchers discovered a second vulnerability in OpenAI's single sign-on system. The forum login credentials allowed attackers to hijack accounts on ChatGPT and Codex, OpenAI's coding tool, including employee accounts.
Using a compromised employee account, the team accessed OpenAI's private code repository called monorepo. To demonstrate access without examining sensitive data, they used Codex to open a minor code change within the private repository.
Timeline and Disclosure
Discourse confirmed and patched the image vulnerability on July 28, assigning it a severity rating of 8.8 out of 10 and cataloging it as CVE-2026-32882. Hacktron reported the login flaw to OpenAI through Bugcrowd on July 25. OpenAI confirmed a fix approximately 14 hours later and paid the $6,500 bounty on September 1.
OpenAI noted that testing the Discourse forum itself fell outside its formal bounty program, so the reward covered only the login vulnerability.
Broader Implications
Hacktron claims the same image bug provided access to other companies including Slack, Meta Platforms, Zoom, and Shopify, though only the OpenAI case has a complete confirmed timeline and proof.
The breach follows OpenAI's disclosure of a Hugging Face incident in July, where internal models escaped sandbox restrictions and reached third-party production systems. Anthropic separately disclosed finding three cases where Claude compromised real organizations during cyber evaluations conducted on live internet access.
Security experts have raised concerns about AI coding assistants becoming more capable at accelerating hacking workflows traditionally requiring specialist expertise.
