RESEARCHERS at cybersecurity company Hacktron used Anthropic’s Claude to demonstrate a chain of vulnerabilities that gave them access to an internal OpenAI software repository. The work was conducted as ethical security research, and the researchers say they avoided viewing sensitive information. They exploited a flaw in Discourse’s image-upload functionality, where the libheif library could be compromised using a specially crafted image, to take control of OpenAI’s Discourse forum server.
They then abused a separate weakness in OpenAI’s single sign-on system, potentially exposing ChatGPT and Codex accounts belonging to people who had logged into the forum, including employees.
One employee’s Codex account was linked to OpenAI’s GitHub organisation, providing access to an internal repository. Rather than causing damage, the researchers instructed the account to create a harmless pull request as proof of access. OpenAI fixed its side of the issue about 14 hours after receiving the initial report and paid Hacktron a $6,500 bug bounty.
The Discourse image-processing weakness was not unique to OpenAI and was subsequently investigated through Hacktron’s “HEIF Heist” project, which identified related weaknesses affecting services and software from Slack, Meta and GitHub.
Hacktron initially used Claude Opus 4.8 to investigate the libheif flaw, but the model could not produce a reliable exploit against default Discourse installations. After Anthropic released Claude Opus 5, the researchers said it generated a working exploit overnight. Claude initially refused to help with exploitation of a remote system, so the researchers framed the task as a capture-the-flag exercise.
Hacktron said the two-month project cost less than $3,000 in AI tokens, while stressing that skilled human guidance remained essential and the activity was not fully autonomous.