The headline sounds like an AI-versus-AI showdown. It was something more revealing: Hacktron AI researchers used AI tools including Anthropic’s Claude while investigating vulnerabilities in OpenAI’s infrastructure.
According to Hacktron and independent reporting, the team chained multiple weaknesses and, in under 72 hours from the initial investigation to demonstrating access to OpenAI’s private openai/openai monorepo, created a harmless pull request through a compromised Codex account. The researchers then stopped testing and disclosed the findings.
This Was Not Claude Hacking OpenAI Alone
The most important distinction is also the easiest one to lose in the headlines. Claude did not independently decide to attack OpenAI. Human researchers chose the targets, interpreted the results, controlled the testing, and stopped once sufficient proof had been obtained. The broader investigation also involved other frontier AI tools, including OpenAI’s own models.
Hacktron used Claude Opus 4.8 and later Opus 5 during exploit development; Opus 5 ultimately produced a working exploit for the libheif issue. The researchers reported that Opus 4.8 initially struggled to produce a reliable exploit, while Opus 5 succeeded and was then used to adapt the exploit to the target environment.
The reported under-72-hour period runs from the initial investigation and discovery to demonstrating access to OpenAI’s internal repository environment. It does not refer to the time between disclosure and the eventual bounty payment. That distinction matters because this was not an autonomous AI attack. Instead, the case demonstrates how AI tools can materially accelerate exploit development and parts of vulnerability research under expert human direction.
What is the reported chain involved?
- OpenAI community forum – the investigation began around community.openai.com, which runs on Discourse.
- Image-processing exposure – Hacktron identified an exploitable Discourse image-processing path that exposed a vulnerable libheif build through ImageMagick.
- Code execution – the researchers exploited the image-processing weakness to gain execution in the forum environment.
- OpenAI sign-in/SSO weakness – a separate weakness in OpenAI’s sign-in token/SSO configuration expanded the impact beyond the forum.
- Multiple employee accounts – Hacktron says the chain compromised multiple OpenAI employee ChatGPT accounts, while the repository proof used a compromised employee’s Codex access.
- Connected Codex/GitHub repository access – the compromised OpenAI account’s Codex connection provided a path into the company’s internal GitHub organization.
- Benign proof of access – researchers created a harmless pull request in OpenAI’s private openai/openai monorepo. It was created as proof and was not accepted or merged.
- Responsible disclosure – the OpenAI-side issue was reported through Bugcrowd, while the Discourse/libheif finding was separately reported to Discourse through HackerOne.
The Initial Weakness Was Traditional Infrastructure
Despite the futuristic AI angle, the reported entry point was not an OpenAI model vulnerability. Hacktron identified an exploitable Discourse image-processing path at OpenAI’s community forum. The relevant flow was Discourse → ImageMagick → libheif for HEIF/HEIC processing. The underlying libheif flaw had already been fixed upstream, but the relevant vulnerable build had not received the necessary security backport, leaving the exposure available through Discourse’s image-processing path.
The technically meaningful chain was:
OpenAI community forum → Discourse → ImageMagick → vulnerable libheif build → code execution → OpenAI sign-in token/SSO weakness → employee ChatGPT/Codex accounts → connected Codex/GitHub repository access
The important point is that the libheif issue and the OpenAI identity weakness were separate problems. Their combination produced a much larger impact than either issue represented on its own. OpenAI did not patch the entire chain itself. OpenAI fixed the sign-in/token-permission issue, while Discourse separately fixed the image-processing/libheif exposure and added sandboxing around image processing.
The remediation moved quickly. OpenAI confirmed its side was fixed roughly 14 hours after the initial report. Discourse responded to its separate report on July 26, had a fix ready on July 27, and published its advisory on July 28.
What Did Hacktron Actually Demonstrate?
The chain compromised multiple OpenAI employee ChatGPT accounts, according to Hacktron. The proof-of-concept repository action, however, used a compromised employee’s Codex access to demonstrate how the account’s connected permissions could reach OpenAI’s internal development environment.
The researchers demonstrated access to OpenAI’s private openai/openai monorepo by creating a harmless pull request through the compromised Codex account. The pull request was a proof of access and was not accepted or merged.
The source-code detail also needs precision. The researchers say they did not download or steal proprietary source code, although OpenAI says limited private-repository reads occurred. Reporting indicates the researchers deliberately avoided examining or downloading sensitive proprietary material beyond what was necessary to demonstrate the impact.
The bounty was also narrower than the overall attack chain. OpenAI paid Hacktron $6,500 for the OpenAI-side SSO/sign-in-token finding. The Discourse/libheif exploitation was separately reported through HackerOne and was outside the scope of OpenAI’s bug-bounty program.
Incident at a glance
| Detail | Reported finding |
| Initial entry point | OpenAI community forum / Discourse |
| Image processing path | Discourse → ImageMagick →libheif |
| Additional weakness | OpenAI sign-in token/SSO configuration |
| AI tools | Claude and other frontier AI tools |
| Timeframe | Under 72 hours to repository proof |
| Account access | Multiple OpenAI employee ChatGPT accounts |
| Repository proof | Pull request created in private openai/openai monorepo |
| Source code | No proprietary source downloaded or stolen, according to Hacktron; OpenAI found limited reads |
| Remediation | OpenAI fixed SSO/ token issue; Discourse patched image processing |
| OpenAI bounties | $6,500 for the SSO/ sign-in-token finding |
| Discourse finding | Separately reported via HackerOne |
Why Does AI-Assisted Security Research Matter?
The most important takeaway is not that Claude “beat” OpenAI. It is that AI can materially accelerate exploit development and parts of vulnerability research under expert human direction. Hacktron’s use of Claude Opus 4.8 and Opus 5 illustrates that shift: the models became part of the researchers’ workflow, while humans remained responsible for choosing targets, interpreting results and controlling the operation.
The case is also inherently dual-use. Faster exploit development can help legitimate researchers identify weaknesses before criminals exploit them, while the same capabilities could potentially lower the time and expertise required for malicious activity.
There is another security lesson underneath the AI headline. A compromised identity becomes substantially more valuable when it is connected to coding tools, repositories, and other internal services. In this case, the forum foothold and identity weakness ultimately intersected with an employee’s Codex-linked developer access.
That puts traditional security fundamentals back in focus: patch low-level dependencies, isolate untrusted file-processing pipelines, constrain sign-in tokens,s and tightly scope permissions between AI tools and corporate systems.
Final Thoughts
The Hacktron case was not an autonomous Claude attack, but a demonstration of how human researchers can use AI to accelerate complex vulnerability discovery and responsibly test the limits of connected systems.
The case shows how AI can compress parts of expert security research from weeks or months into days without removing the need for human oversight.
(Source)