TL;DR: Three Hacktron researchers used Anthropic's Claude to chain an image-parsing flaw and an OpenAI sign-in flaw to take over employee ChatGPT and Codex accounts and open a proof-access pull request in OpenAI's internal monorepo in under 72 hours in July.

What happened on OpenAI's forum

Three independent security researchers at Hacktron say they compromised multiple OpenAI employees' ChatGPT accounts on July 25, 2026, after chaining two critical vulnerabilities, according to The Verge.

The researchers are identified as Harsh Jaiswal, Mohan Pedhapati and Rahul Maini in a writeup about their research, according to The Register.

The entry point was OpenAI's community forum at community.openai.com, which runs on Discourse, according to SecurityWeek.

The team obtained remote code execution and administrative access to the Discourse environment hosted at community.openai.com between 05:00 and 06:00 UTC on July 25, 2026, according to the Hacktron AI technical account of the incident.

They then submitted a report through OpenAI's Bug Bounty Program on Bugcrowd between 08:00 and 10:00 UTC that same day, according to the Hacktron AI technical account.

Between 13:30 and 15:30 UTC, they used an employee's Codex account to open a harmless proof-of-concept pull request in OpenAI's internal monorepo and then stopped further testing, according to the Hacktron AI technical account.

The entire timeline from initial discovery to access to OpenAI repo access took place in less than 72 hours, according to the Hacktron AI technical account.

How a photo file became remote code execution

The attack started with HEIF image uploads, according to SecurityWeek.

Discourse's built-in image checks didn't support the HEIC/HEIF photo format, so uploads in that format were passed to ImageMagick, exposing an unpatched flaw in the libheif library it relies on for decoding, according to SecurityWeek.

The forum runs on Discourse, which typically uses FastImage to perform image checks, but since FastImage didn't support HEIF files in the affected setup, HEIF images uploaded to Discourse passed through ImageMagick, which used libheif to process them before converting them to another image format, according to The Register.

That exposed the underlying libheif parser directly to attacker-controlled files, as the researchers described the upload path, according to The Register.

Hacktron says the underlying bug had been fixed upstream a year earlier without ever being flagged as a security issue, so it was never assigned a CVE and missed the usual patching cycle, according to SecurityWeek.

Using Claude Opus 4.8, the trio found a heap buffer overflow flaw in the libheif library and attempted to use that model to develop a remote code execution attack, but this didn't work on Discourse's default configuration, according to The Register.

Anthropic released Claude Opus 5 in the evening on July 24, and the researchers then used the newer model to generate an exploit script and achieved remote code execution on OpenAI's instance, according to The Register and The Verge.

According to Hacktron, Claude Opus 5 launched in the evening on July 24th, and by 10AM the next day they had used it to achieve RCE on Discourse Cloud and accessed OpenAI's instance, according to The Verge.

The researchers' own exploit timeline says Opus 4.8 got code execution working with ASLR disabled on July 24, and Opus 5 turned it into a working image-upload exploit with ASLR on at 06:00 UTC on July 25, according to the Hacktron AI technical account.

The same timeline says the exploit worked against a Discourse Cloud test instance and then OpenAI's forum at 10:00 UTC on July 25, according to the Hacktron AI technical account.

The researchers traced Discourse's HEIF upload path through ImageMagick to libheif and found the heap overflow on July 23, according to the Hacktron AI technical account.

How forum access became ChatGPT and Codex account access

Because the forum let people sign in with their OpenAI account, code execution there opened a path to broader account access, according to SecurityWeek.

OpenAI uses Discourse for their forum and allows "Sign in with OpenAI" through auth.openai.com, according to the Hacktron AI technical account.

The OpenAI weakness was related to sign-in tokens generated for the community forum carrying excessive permissions and granting full API access to associated ChatGPT and Codex accounts, according to SecurityWeek.

Hacktron says that until the issue was fixed, any user or employee who logged into the forum could have had their ChatGPT and Codex accounts taken over, according to SecurityWeek.

The researchers wrote, "Until two months ago, any user or OpenAI employee logging into OpenAI's own help forum (community.openai.com) could have had their ChatGPT and Codex accounts taken over," according to The Register.

Since people can connect various services to Codex and ChatGPT, the researchers said the scope of what they could theoretically access was huge, including GitHub, Slack and emails, according to the Hacktron AI technical account.

In addition, since people often connect other services to those accounts, the theoretical exposure extended to services like GitHub, Slack and email, according to SecurityWeek.

To demonstrate the access without reading any internal code, Hacktron says it took over an OpenAI employee's account whose Codex integration was linked to OpenAI's GitHub organization, then used it to open a pull request in an internal repository before stopping further testing, according to SecurityWeek.

The researchers wrote, "We then took over an OpenAI employee's account, whose Codex was connected to OpenAI's Github organization," according to The Register.

They added, "To demonstrate impact without actually accessing any internal code, we sent a prompt to this employee's Codex account to open a PR for us in OpenAI's internal monorepo. Then we stopped any further testing," according to The Register.

To prove access without learning sensitive information, they used the employee's Codex to open PR #1186742 in OpenAI's internal monorepo openai/openai, according to the Hacktron AI technical account.

They stopped short of accessing internal code in Monorepo themselves, but sent a pull request from an employee's Codex account to prove they gained access, according to The Verge.

They were able to access OpenAI's GitHub repository, called "Monorepo," which reportedly contains "OpenAI's algorithmic secrets," according to sources cited by The Wall Street Journal and summarized by The Verge.

OpenAI said its own review of the incident found limited reads of private-repository metadata and commits, followed by the researcher-submitted pull request, specifically to a README file, according to SecurityWeek.

Hacktron's report also raises Slack as a service that could theoretically have been reached through connected accounts, while OpenAI says Hacktron did not verify actual access to employee Slack messages, according to SecurityWeek.

How OpenAI and Discourse responded

OpenAI distinguishes between the two flaws, telling SecurityWeek that the image-processing bug lived in the third-party service Discourse, while the account-takeover path was a separate, OpenAI-side issue, according to SecurityWeek.

OpenAI replied to the Bugcrowd report confirming the issue had been fixed roughly 14 hours after the initial submission, at 22:49:45 UTC on July 25, 2026, according to the Hacktron AI technical account.

OpenAI fixed the flaw within about 14 hours of the report's submission, marked the issue as resolved, and paid the Hacktron team a $6,500 bounty, according to The Register.

The company paid Hacktron a $6,500 bounty for the OpenAI-side finding, according to SecurityWeek.

OpenAI commented, "To clarify the scope of that award: testing against the Discourse-hosted community.openai.com was explicitly excluded from our bug bounty program. The award recognizes the OpenAI-side finding, not the actions against Discourse," according to The Register.

OpenAI said in a statement, "We thank the researchers for contacting us and sharing their findings. We narrowed the permissions on Community sign-in tokens and revoked affected tokens and sessions," according to SecurityWeek.

The researchers said they immediately reported the initial vulnerability to OpenAI and Discourse and worked with them to coordinate the patch, according to the Hacktron AI technical account.

They separately submitted a report to Discourse through its HackerOne program on July 25, 2026, Discourse replied on July 26, and Discourse had a fix ready by July 27 that added image-processing sandboxing as defense in depth, according to the Hacktron AI technical account.

Discourse had a fix ready within two days and added image-processing sandboxing as an extra layer of defense, then published a security advisory, according to SecurityWeek.

Discourse published GHSA-vhm9-85gw-x335 with patch and rebuild guidance on July 28, 2026, according to the Hacktron AI technical account.

OpenAI rewarded the $6,500 bounty and marked the issue resolved on Sept. 1, 2026, according to the Hacktron AI technical account.

Why researchers call it HEIF Heist

The researchers have expanded the work into HEIF Heist, described as a multi-month investigation tracing libheif across Slack, Meta, GitHub Enterprise, Ruby on Rails, and Node.js frameworks such as Next.js, Astro, and Gatsby, according to the Hacktron AI technical account.

Their HEIF Heist project took "only one or two days" to adapt to different companies, including OpenAI, Slack, Meta, GitHub Ent, Rails, Next.js, ImageMagick, and others, using less than $3,000 in tokens, and to their knowledge was only detected by one target, Shopify, according to The Verge.

The team said work that once required a well-resourced team and months of effort can now be compressed into days, adding that security assumptions must catch up with attacker capabilities, according to The Register.

Hacktron CTO Mohan Pedhapati told The Wall Street Journal, "I don't think we are as strong as Chinese threat actors... We're just three guys with Claude and Codex subscriptions," according to The Verge.

The vulnerabilities Hacktron reported to Discourse and OpenAI have since been fixed, according to The Verge.

For self-hosted Discourse sites, the researchers advise rebuilding the installation because older Docker images may contain a vulnerable libheif dependency that permits code execution through an image upload, while Discourse-hosted customers have already been patched, according to the Hacktron AI technical account.

Sources referenced