Was the OpenAI hack authorised?

Yes. Hacktron AI ran the work through OpenAI's bug-bounty program and reported what it found instead of using the access. OpenAI confirmed a fix roughly 14 hours after the report and awarded $6,500 on 1 September 2026, noting the award covers the OpenAI-side finding rather than the actions against Discourse, which the team also reported upstream.

Why did Claude Opus 5 succeed where Opus 4.8 failed?

Hacktron's writeup says Opus 4.8 struggled on 24 July to produce a reliable exploit with ASLR enabled. Anthropic released Claude Opus 5 that evening, the team handed it the same problem the next morning, and it reached working remote code execution in under three hours. Hacktron used a version of the model made available to cybersecurity researchers.

What did the researchers actually get access to?

Hacktron took over an OpenAI employee's account whose Codex instance was connected to OpenAI's GitHub organisation. Rather than reading internal source, the team demonstrated the reach by having Codex open pull request #1186742 in OpenAI's internal monorepo, which shows write access to the repository without taking any code.

Are other Discourse sites exposed to the same bug?

Hacktron warns that any Discourse deployment missing the latest upstream security patches is potentially vulnerable, because the flaw sits in libheif reached via ImageMagick during image upload rather than in Discourse itself. Discourse issued a fix on 27 July 2026 after the researchers alerted the project.

Hacktron AI · 2026-09-18 · major

Hacktron used Claude to reach OpenAI's internal code repository

Hacktron AI published how its three-person team used Claude Opus 5 to build an exploit for a heap overflow in libheif, take over an OpenAI employee's ChatGPT and Codex accounts, and open a pull request in OpenAI's internal monorepo.

Illustration from Hacktron AI's writeup on its OpenAI bug-bounty finding

Three researchers used Claude Opus 5 to chain an image-decoder bug into an OpenAI employee's account and, from there, the company's internal monorepo.

Quick facts

Researchers	Hacktron AI, a three-person team
Model used	Claude Opus 5
Flaw	Heap buffer overflow in libheif, reached through Discourse image uploads
Entry point	community.openai.com
Time to repo access	Under 72 hours
Token cost	Under $3,000
Bounty	$6,500

What is it?

The exploit chain is the story here: Hacktron AI, a three-person security startup, entered through OpenAI's community forum, which runs Discourse, and finished with a pull request in OpenAI's internal monorepo. The work was done inside OpenAI's bug-bounty program, reported rather than exploited, and paid — $6,500. OpenAI says the issues are resolved.

How does it work?

Discourse hands uploaded HEIC and HEIF images to ImageMagick, which used a build of libheif carrying a heap buffer overflow. Claude Opus 4.8 could not produce a reliable exploit against ASLR; when Opus 5 shipped that evening the team gave it the same problem and had remote code execution in under three hours. An OpenAI SSO misconfiguration then turned forum access into an employee's ChatGPT and Codex session, and that Codex account was connected to OpenAI's GitHub organisation.

Why does it matter?

Writing a working memory-corruption exploit has been the slowest, most specialised step in offensive security. Hacktron puts numbers on how fast that is shifting: under 72 hours from first look to repository access, for less than $3,000 of model tokens, by three people. The chain is also a reminder that a community forum running third-party software counts as part of your attack surface.

Who is it for?

security engineers

Frequently asked questions

Was the OpenAI hack authorised?: Yes. Hacktron AI ran the work through OpenAI's bug-bounty program and reported what it found instead of using the access. OpenAI confirmed a fix roughly 14 hours after the report and awarded $6,500 on 1 September 2026, noting the award covers the OpenAI-side finding rather than the actions against Discourse, which the team also reported upstream.
Why did Claude Opus 5 succeed where Opus 4.8 failed?: Hacktron's writeup says Opus 4.8 struggled on 24 July to produce a reliable exploit with ASLR enabled. Anthropic released Claude Opus 5 that evening, the team handed it the same problem the next morning, and it reached working remote code execution in under three hours. Hacktron used a version of the model made available to cybersecurity researchers.
What did the researchers actually get access to?: Hacktron took over an OpenAI employee's account whose Codex instance was connected to OpenAI's GitHub organisation. Rather than reading internal source, the team demonstrated the reach by having Codex open pull request #1186742 in OpenAI's internal monorepo, which shows write access to the repository without taking any code.
Are other Discourse sites exposed to the same bug?: Hacktron warns that any Discourse deployment missing the latest upstream security patches is potentially vulnerable, because the flaw sits in libheif reached via ImageMagick during image upload rather than in Discourse itself. Discourse issued a fix on 27 July 2026 after the researchers alerted the project.