A Claude-Assisted Image Exploit Reached OpenAI Repositories in Under 72 Hours

Hacktron researchers used Claude while chaining two vulnerabilities on July 25, 2026: remote code execution through image processing on OpenAI’s Discourse forum, followed by a weakness in OpenAI’s single sign-on flow. Hacktron’s published timeline says the chain reached multiple employee ChatGPT accounts and OpenAI’s internal repositories in under 72 hours; the team proved access by having one employee’s connected Codex account open a harmless pull request in an internal monorepo.

The episode did not establish that Claude autonomously breached OpenAI or that the researchers copied private source code. The Register’s independent account says OpenAI fixed its side roughly 14 hours after the report, marked the issue resolved and paid a $6,500 bounty; OpenAI clarified that the award covered its identity flaw, not testing of the out-of-scope Discourse forum.

The entry point was a decoder below Discourse

The first vulnerability was not in ChatGPT, Codex or Claude. OpenAI’s community forum accepted HEIC and HEIF uploads through Discourse. Because the affected image-checking path did not handle those formats directly, it passed them to ImageMagick, which invoked the native libheif decoder on attacker-controlled content.

The installed libheif package lacked an upstream security change and contained a heap-buffer-overflow flaw. The researchers first made the flaw produce code execution with address-space layout randomization disabled, then developed an exploit that worked against the default Discourse environment. On July 25, they obtained remote code execution and administrative access to the forum environment.

This makes the dependency chain central to the incident: Discourse accepted the upload, ImageMagick selected the conversion path, and libheif parsed the malformed image. Monitoring only the application version would not necessarily reveal that the deployed container still carried a vulnerable native library.

An OpenAI identity flaw turned forum access into repository reach

Remote code execution on the forum did not by itself grant access to OpenAI’s repositories. The second vulnerability was in OpenAI’s identity flow: users could sign in to the forum with an OpenAI account, and the researchers found a way to cross that boundary and take over active users’ ChatGPT and Codex accounts, including accounts belonging to OpenAI employees.

One compromised employee account had Codex connected to OpenAI’s GitHub organization. The researchers prompted that Codex account to create a proof-of-concept pull request in the private openai/openai monorepo, then stopped testing. The demonstrated impact was therefore a repository action performed through existing connected authority—not evidence that the team browsed or copied OpenAI’s internal code.

The researchers described GitHub, Slack and email as services that might be exposed through connected accounts. Those references define potential reach, not confirmed access to every service. The verified chain ends with employee account takeover and one harmless internal pull request.

Claude supplied exploit work; humans controlled the operation

Claude’s contribution was substantial but bounded. Opus 4.8 identified missing security fixes and produced an exploit that worked only with a memory protection disabled. After Anthropic released Opus 5, the newer model produced a working ARM64 version and helped adapt it to the x86-64 and jemalloc environment used by Discourse; the team also ran it autonomously against a Discourse instance they controlled.

The three researchers—Harsh Jaiswal, Mohan Pedhapati and Rahul Maini—still chose the target, framed the tasks, supplied the environments, transferred the generated exploit to OpenAI’s forum, validated the account-takeover path and decided how to demonstrate impact. They also stopped the test and submitted the findings to OpenAI and Discourse. “Claude-assisted” describes the evidence more accurately than a claim that the model independently selected and completed the operation.

The reported timing—several days of agent work and several hours of human work—shows that a model compressed part of the exploit-development process. It does not demonstrate that the same chain would be found reliably without researchers capable of recognizing useful output, configuring realistic targets and connecting separate technical weaknesses.

The remediation has three distinct layers

The image-processing flaw is tracked as CVE-2026-32882. The official Discourse advisory rates it High at 8.8, lists patched releases 2026.7.0, 2026.6.1, 2026.5.2 and 2026.1.6, and says the latest Docker image includes patched libheif. It instructs self-hosted operators to rebuild the application and notes that supported Discourse versions add image-processing sandboxing where the host kernel permits it.

The chain translates into separate checks for dependencies, isolation and identity:

• Rebuild self-hosted Discourse deployments from the current official image; a successful web-interface update does not prove that the underlying container or libheif package changed.
• Verify the libheif package inside each running container or image. A distribution may backport a security fix without adopting the latest upstream version number, so the package security advisory matters as well as the displayed version.
• Disable HEIC, HEIF and AVIF decoding where it is unnecessary. Where it is required, run conversion in a restricted, short-lived sandbox with limited filesystem, process and network access.
• Test whether a low-trust forum or support service can issue, relay or reuse credentials accepted by higher-value products. Review and revoke sessions or tokens created through an affected identity path.
• Inventory integrations attached to employee ChatGPT and Codex accounts, then limit repository and collaboration permissions so one account takeover cannot inherit broader authority than its task requires.

The precise OpenAI SSO defect has not been publicly disclosed, so the public record does not support a product-specific configuration fix beyond OpenAI’s statement that the issue was resolved. What is established is that patching libheif alone would have left the identity weakness, while correcting SSO alone would not have removed the image-decoder execution path.

The disclosed chain is closed, but its boundary lesson remains

Discourse published its advisory on July 28 after preparing a fix and additional sandboxing, while OpenAI marked its issue resolved and paid the bounty on September 1. The researchers published their account on September 13, and independent coverage followed on September 18.

No selected disclosure shows proprietary source code being copied or the possible Slack and email routes being used. The confirmed outcome remains narrower and still consequential: a malformed image reached a vulnerable native dependency, forum compromise crossed an OpenAI identity boundary, and an employee’s connected Codex authorization carried the chain into a private repository.

Also read:

• Claude Reached Real Systems in Four Tests—Isolation Failed Every Time
• OpenAI Counts 3.1 Agent-Days per Human Day—That Is Not 3.1× Productivity
• Claude Closed 65% of a Safety Gap in 60 Hours—but Not the Last Mile