Three security researchers reported that they breached OpenAI's infrastructure in under 72 hours, using Claude to help build the exploit, and then told OpenAI about it through its own bug bounty program. The breach itself — a bug in an image-upload pipeline that ends in a pull request against an internal repository — is a solid piece of security research. The detail worth sitting with is smaller: an earlier Claude model couldn't finish the exploit, and the next one did, in the same afternoon it shipped.
That's not a story about Claude "hacking OpenAI." It's a story about what happens to your threat model when the tool your adversary — or you — are using gets meaningfully better overnight.
TL;DR
| Question | Answer |
|---|---|
| Who did this? | Harsh Jaiswal, Mohan Pedhapati, and Rahul Maini, researchers at Hacktron |
| What was the entry point? | HEIC/HEIF image uploads on community.openai.com (runs on Discourse) |
| What was the underlying bug? | Discourse passed HEIC files to ImageMagick's magick/libheif instead of FastImage, exposing an unhardened parser to attacker-controlled files |
| What did it turn into? | A libheif heap overflow → RCE → an OpenAI SSO/employee-auth flaw → employee ChatGPT/Codex account takeover → access to a connected GitHub account → a proof-of-access pull request on an internal repo |
| Did Claude run the attack autonomously? | No — researchers used it as a tool. A special Opus 4.8 build failed across several sessions; Opus 5 succeeded within hours of release |
| Was this malicious? | No — responsible disclosure via OpenAI's bug bounty program |
| How fast was the fix? | OpenAI confirmed its side fixed ~14 hours after the initial Bugcrowd submission; Discourse shipped a fix and added sandboxing within days |
| What did OpenAI pay? | $6,500 |
| Does Beam block anything like this? | No — Beam observes and flags locally; it doesn't intercept or prevent remote exploits against third-party infrastructure |
The exploit chain
Research began July 23, 2026, when Hacktron's team started examining the image-upload pipeline on OpenAI's community forum, community.openai.com, which runs on the Discourse platform. Discourse normally validates uploaded images with FastImage. FastImage doesn't support HEIC/HEIF files, so Discourse's code path handed those files to ImageMagick's magick command instead — exposing the underlying libheif parser directly to attacker-controlled input (Tom's Hardware).
That single routing decision — send the unsupported format to a different, less-scrutinized parser — is the kind of gap that's easy to miss in code review and easy to find once you're specifically looking at how a validation library's format list doesn't match what the application actually accepts.
From there, the chain moved in a straight line:
- HEIF upload → libheif heap overflow. A crafted HEIC/HEIF image triggered memory corruption in libheif.
- Heap overflow → remote code execution. The corruption was developed into working RCE on the server handling the upload.
- RCE → employee account access. Combined with a separate flaw in OpenAI's SSO/employee-authentication flow, the researchers took over ChatGPT and Codex employee accounts.
- Employee account → GitHub access. One of those accounts had a connected GitHub account, giving the researchers reach into source control.
- GitHub access → internal repository. The team opened a pull request against an internal, private OpenAI repository — described as harmless — purely as proof that the chain worked end to end (TechCrunch, NBC News).
Total elapsed time from the original discovery to reaching an internal repository: under 72 hours.
The part that matters: Opus 4.8 failed, Opus 5 didn't
Here's the detail that separates this from a routine (if impressive) bug bounty writeup. Per Hacktron's own account of the research, the team had access to a special version of Claude Opus 4.8 made available to cybersecurity researchers, and used it to try to build a working exploit. It didn't work — not once, but across several separate sessions.
Then Anthropic released Opus 5. Hacktron gave the new model the identical problem. In their words:
"Opus 4.8 struggled across several sessions to produce a working exploit... Within hours of Opus 5's release, we gave it the same problem and it succeeded." — Hacktron, via SoFX
Nothing else changed between those two attempts — same researchers, same target, same bug. The only variable was which model version sat behind the tool. That's the mechanism worth remembering: a task can be genuinely out of reach for a model one week and routine for its successor the next, with no warning in between and no change on the defender's side.
This cuts in both directions. The same capability jump that let Hacktron's team finish an exploit chain in hours is available to defenders reviewing their own pipelines, auditing their own upload handlers, or fuzzing their own dependency choices. A model release isn't just a product update — it's a step change in what's practical to attempt with an LLM sitting in the loop, for whoever reaches for it first.
Response and timeline
Discourse was notified of the libheif issue on July 26, 2026. It had a fix ready the next day, July 27, and added sandboxing around its image-processing pipeline as a defense-in-depth measure — not just a patch to the specific parser call (Malwarebytes).
On OpenAI's side, the company confirmed its portion of the issue was fixed at 10:49:45 p.m. UTC — about 14 hours after Hacktron's initial submission through Bugcrowd. OpenAI paid the team a $6,500 bounty for the report. The story became public reporting around September 18-20, 2026, roughly two months after the original research window.
Read plainly, this is disclosure working the way it's supposed to: a serious chain, found by researchers with permission to look, reported through the intended channel, fixed within a day on the platform side and within about 14 hours on OpenAI's side.
What this means for AI agent security
Two things are true at once here, and it's worth separating them cleanly.
Claude wasn't the vulnerability. The weak points in this chain were OpenAI's own infrastructure choices — a format-mismatch bug in how Discourse routed image validation, and a separate flaw in employee SSO. Claude was the capability multiplier that let three researchers move through exploit development faster than they otherwise could have. That's a meaningfully different claim than "an AI model broke into OpenAI."
The capability jump is the real signal, not the breach details. If you run Claude Code, Codex, or a similar agent against your own infrastructure — your own upload handlers, your own auth flows, your own internal tooling — the lesson isn't "watch out for HEIC uploads." It's that the ceiling on what an agent can help build or find moves with every model release, sometimes discontinuously. An attack surface you dismissed as "too hard for a model to exploit in practice" is a moving target, not a settled fact.
That's also the argument for local visibility into what your own coding agents actually touch. Per apps/sentinel-collector/README.md, Beam is a local prototype that pairs with a running Claude Code or Codex session, ingests normalized events over a PreToolUse/PostToolUse hook or the /ingest and /v1/logs endpoints, and stores them under apps/sentinel-collector/.data with known credential formats, auth headers, and URL query parameters redacted before persistence. Its skill and MCP scanner runs 11 heuristic patterns — including credential-delivery and downloaded-and-executed code shapes — against a SKILL.md or MCP config before you run it.
None of that would have stopped Hacktron's chain — it targeted OpenAI's own servers, not a local agent session, and Beam doesn't block or intercept anything in v1 regardless of target. What it's built for is a narrower, honest job: if your own agent is the one touching credentials, running commands, or fetching untrusted content on your machine, you get a local record of what happened and a heuristic first pass on anything you're about to install — not a guarantee, a first look.
Summary
Hacktron's researchers turned a HEIC-upload routing bug in OpenAI's Discourse-based community forum into a full chain — heap overflow, RCE, employee account takeover, GitHub access, and a proof-of-access pull request against an internal repository — in under 72 hours, and reported it responsibly for a $6,500 bounty. The detail that should stick with anyone running AI coding agents is narrower than the breach itself: a special build of Claude Opus 4.8 failed to produce a working exploit across multiple sessions, and Claude Opus 5 succeeded within hours of its release, on the identical problem. Model upgrades change what's feasible for both attackers and defenders, often without warning, which is its own argument for keeping a local record of what your own agents are actually doing.
Related reading: What is AI agent monitoring? · MCP security: a practical guide · AI agent security incidents: a timeline · Anthropic's Sept 2026 threat report: agents as orchestrators · Agentjacking: how a Sentry MCP integration hijacks coding agents · Cursor's MCP config poisoning: CurXecute and MCPoison
Sources: Tom's Hardware · TechCrunch · NBC News · SoFX · Malwarebytes
This account reflects public reporting as of September 23, 2026. Details attributed to Hacktron's own writeup and to OpenAI's and Discourse's responses may be updated as more information becomes available.