Three researchers at Hacktron AI leveraged Anthropic's Claude Opus 5 to chain multiple vulnerabilities into a complete attack path from a forum image upload to OpenAI's private GitHub monorepo, accomplishing the feat in under 72 hours.
The team initially identified a memory-corruption vulnerability in a widely used image library. When they attempted to weaponize it using Claude Opus 4.8 in late July, the model could only produce a working exploit with the operating system's address space layout randomization disabled—a protection that runs on every production server. That same evening, Anthropic released Opus 5.
The researchers returned the next morning with the new model and the same vulnerability. Within roughly three hours, Opus 5 had generated a functional ARM64 exploit targeting a Mac on their desk. Four hours later, they achieved remote code execution against a test forum. Less than 72 hours from start to finish, they were accessing OpenAI's private monorepo using an OpenAI employee's Codex account to open a pull request against a README file before halting their demonstration.
The vulnerability chain began with image handling
The underlying flaw did not originate from OpenAI's own code. Hacktron was testing community.openai.com, OpenAI's user forum, which runs Discourse—the same off-the-shelf forum platform powering thousands of other websites.
Discourse typically processes uploaded images through FastImage, but this tool cannot handle HEIC and HEIF formats. Those files instead get routed to ImageMagick, which decodes them using libheif. The version deployed in the Debian 12 base image used by the forum, version 1.19.7, contained a heap buffer overflow that a specially crafted file could trigger.
A patch had been committed upstream a year earlier. However, the commit was not marked as a security fix and never received a CVE designation, preventing it from triggering a backport into the Debian package running on the forum—leaving a patched vulnerability exploitable simply because it lacked proper labeling.
The researchers adapted the exploit to match the x86-64 and jemalloc configuration that Discourse uses, and a malformed HEIC image proved sufficient to trigger remote code execution.
Discourse later confirmed the vulnerability in security advisory GHSA-vhm9-85gw-x335, assigning the upstream libheif flaw—tracked as CVE-2026-32882—a CVSS severity score of 8.8 out of 10.
Escalation through overpermissioned tokens
Achieving code execution on a forum represents a serious incident for the forum operator, but should not directly compromise the parent organization. The attack chain, however, crossed into OpenAI's own infrastructure when Hacktron discovered a flaw in OpenAI's single sign-on system: authentication tokens issued for the forum carried excessive permissions, granting complete API access to linked ChatGPT and Codex accounts. Several of these accounts belonged to OpenAI employees.
One employee's Codex account maintained a connection to OpenAI's GitHub environment, creating a direct path to the company's private repositories. Hacktron indicates that other compromised accounts could have exposed additional connected services including Slack and email.
The team deliberately halted their access at this point. Using the Codex account, they made a harmless documentation change to OpenAI's private openai/openai monorepo and opened a pull request—sufficient to demonstrate real access without causing harm. According to Hacktron's account, the pull request details were redacted at OpenAI's request.
Autonomous exploitation without human intervention
Having completed the initial attack with human researchers involved throughout, Hacktron conducted a second experiment with minimal human participation.
They deployed Claude in an autonomous agent loop—providing it with a goal, a target, and time to continue working—directed at a Discourse instance under their control. The model independently achieved remote code execution and demonstrated the capability by reading /etc/hosts from within the container.
Initiating the autonomous run required one workaround: Opus declined to write an exploit targeting a live remote host. The team circumvented this by proxying their own instance through rce.ee/ctf-forum, a URL that presented the target as part of a capture-the-flag competition.
Memory-corruption exploitation has always been specialist work, invovling memory layouts, allocators, operating system internals, and protections to make all of it wildly unreliable. Hacktron's run signals a meaningful share of that work might be able to be delegated to AI now. It also suggests the line between security research and attack development is — from the model's side, anyway — partly a question of what you consider a target.
The complete attack sequence
- HEIF upload to forum
- libheif buffer overflow triggered
- Code execution achieved on forum server
- Over-permissioned SSO tokens obtained
- Employee ChatGPT and Codex account compromised
- Connected GitHub access gained
- Pull request opened in openai/openai repository
Scope and cost of the research
The OpenAI intrusion represented one component of a larger initiative Hacktron termed "HEIF Heist," a roughly two-month investigation of image-processing infrastructure across multiple major technology companies. The entire project consumed less than $3,000 in model token costs.
OpenAI issued Hacktron a $6,500 bounty for the account-takeover vulnerability on its platform. The company has since restricted permissions on community sign-in tokens and revoked all affected tokens and sessions.