Security researchers from startup Hacktron AI used Anthropic’s Claude Opus 5 to exploit a memory-corruption vulnerability in OpenAI’s community forum on July 25, 2026, successfully compromising an employee’s account and reaching internal GitHub repositories.
What was intended as an authorized test of frontier artificial intelligence security ended up exposing a critical chain of vulnerabilities reaching deep into internal software infrastructure. A three-person team from San Francisco-based cybersecurity startup Hacktron AI managed to breach OpenAI in under 72 hours, chaining an image-processing flaw on a public forum with an identity single sign-on weakness to gain access to corporate developer systems.
Exploiting Discourse and Libheif with Claude
The attack vector targeted OpenAI’s community forum, community.openai.com, which runs on Discourse. The researchers discovered that HEIC and HEIF images uploaded to the discussion board were processed through ImageMagick and decoded using libheif. According to security startup Hacktron AI, the specific version of libheif present in that environment contained a heap buffer overflow capable of evolving into remote code execution.
To operationalize the memory-corruption bug, the team initially employed Claude Opus 4.8. However, the model struggled to bypass address-space layout randomization, a core security protection designed to block memory attacks. When Anthropic released Claude Opus 5, the researchers switched models. The updated AI helped them create a working exploit within hours.
From Forum Foothold to Internal GitHub Codebase
Remote code execution on the forum served only as the initial stage of the operation. Hacktron identified a separate flaw in OpenAI’s single sign-on implementation, allowing them to turn control of the forum environment into access to active authentication tokens for ChatGPT and Codex accounts belonging to users who authenticated through the service, including OpenAI employees.
Once inside an affected employee account, the potential impact widened based on connected enterprise tools. In this proof of concept, the compromised Codex environment was linked directly to OpenAI’s internal GitHub organization.
We proved it with a PR in OpenAI’s internal codebase. It took us <72h.
s1r1us, AI researcher via CoinPedia
Rather than examining sensitive source code, the team instructed Codex to make a benign change and prepare a pull request in the internal openai/openai monorepo, demonstrating full access while minimizing exposure to proprietary intellectual property.
Anthropic’s Cyber Verification Program and AI-Assisted Attacks
The operation was conducted under specific authorized conditions. According to Hacktron cofounder and CEO Zayne Zhang, the startup had been granted access to Anthropic’s Cyber Verification Program, which relaxed certain standard security restrictions on Claude for authorized vulnerability research.
This dynamic illustrates a broader shift in software security economics. By automating exploit chains against memory-corruption bugs, AI models reduce the amount of scarce technical expertise required to build reliable attacks. Work that once required months of manual effort can now be compressed into days.
OpenAI’s Fix, Bug Bounty, and Industry Fallout
Following the disclosure, OpenAI paid the three researchers a $6,500 bounty under its bug bounty program. Discourse also patched the underlying vulnerability with a security advisory assigning the issue a CVSS score of 8.8, while adding strict sandboxing around image processing.
We thank the researchers for contacting us and sharing their findings. We narrowed the permissions on Community sign-in tokens and revoked affected tokens and sessions.
OpenAI spokesperson, via Business Insider
The incident arrives amid heightened industry sensitivity regarding autonomous AI capabilities. Just weeks earlier, OpenAI disclosed an experiment where AI models broke out of a sandboxed testing environment to target Hugging Face. Security researchers point out that as frontier labs integrate AI coding agents directly with collaboration platforms, email, and source control repositories, the blast radius of a single identity compromise expands exponentially.
Unresolved Architectural Risks in Connected AI Systems
The Hacktron disclosure demonstrates that securing an AI chatbot is no longer simply a matter of filtering conversational outputs. When an AI agent functions as an operational bridge connected to GitHub, Slack, and cloud storage, compromising the underlying identity session inherits the permissions of every integrated enterprise tool.
Whether frontier labs can successfully implement sufficient isolation layers before autonomous models are deployed deeper into enterprise production workflows remains an open question for engineering teams across the sector.