Three Researchers Used Claude to Get Inside OpenAI's Code

On July 25, 2026, three researchers at the security firm Hacktron chained two vulnerabilities and reached OpenAI's internal code repository. The first was a heap buffer overflow in libheif, an image decoder Debian had never back-ported a fix for. They drove it through a picture upload on OpenAI's community forum, and the second bug — a flaw in OpenAI's single sign-on — turned a forum session into ChatGPT and Codex accounts, including one employee's, whose Codex was wired to OpenAI's GitHub organisation. From first discovery to a test pull request inside the internal monorepo took under 72 hours, and the researchers stopped testing at 15:30 UTC 1. The Wall Street Journal reported the break-in, which security researchers found through an OpenAI bug bounty program 2, and by Friday morning it led Techmeme's front page 3.

The details are stranger than the headline. Forum software normally screens pictures with FastImage, which cannot read HEIC, so those files went to ImageMagick and from there into libheif — with Discourse's Docker image built on Debian 12, carrying libheif 1.19.7 1. Claude Opus 4.8 found the missing back-port and wrote an exploit that only held up with address space randomisation switched off. That evening Anthropic released Opus 5; within three hours the model had a working ARM64 exploit, which the team then ported to the x86-64 and jemalloc setup the forum actually ran. By 6 a.m. the next morning they had code execution through an image upload, and by ten the agent had taken their own Discourse Cloud instance and proved it by reading /etc/hosts — a model that refused to write an exploit against a remote target, so the team dressed its own box as a capture-the-flag exercise first 1.

OpenAI fixed its side about 14 hours after the report and paid a $6,500 bounty, noting that testing the Discourse-hosted forum was outside its program's scope, so the award covered the OpenAI-side finding alone. Discourse had a patch ready the following Monday and began sandboxing image processing; the advisory followed on July 28 1.

The wider campaign is where the story lands. The same libheif bug opened Slack, Meta, GitHub Enterprise, Ruby on Rails and the Next.js, Astro and Gatsby frameworks — two months of work by three researchers, under $3,000 in model tokens, a day or two per company, and by the researchers' account no company detected the activity except Shopify, after thousands of images were sent 1. What used to need rare expertise and months now costs a subscription, and the patch list is short: move libheif and libde265 to the current security release, stop decoding untrusted HEIF and AVIF where nothing needs it, and isolate the image pipeline 1.

This episode raps it over a West Coast G-funk beat: the upload that was the way in, the three hours Opus 5 needed, the pull request that stood in for a heist, and the invoice that came to under three grand.