“Until two months ago, any user or OpenAI employee logging into OpenAI’s own help forum (community.openai.com) could have had their ChatGPT and Codex accounts taken over,” Hacktron researchers Harsh Jaiswal, Mohan Pedhapati, and Rahul Maini wrote in a technical writeup describing how they chained flaws to seize access to multiple OpenAI accounts.
How Claude Opus 4.8 and Opus 5 were used to develop an exploit
The Hacktron team began with Anthropic’s Claude Opus 4.8 to identify a heap buffer overflow in the libheif library, the researchers said. Their initial attempt to convert that finding into a remote code execution (RCE) exploit did not succeed against Discourse’s default configuration. When Anthropic released Claude Opus 5, the researchers used the newer model to generate an exploit script that did achieve RCE on OpenAI’s Discourse instance.
The researchers describe the work as a short handoff between an AI agent and human engineers: “The entire hack took a few days for an AI agent and a few hours of human work,” they said. “Work that once required a well-resourced team and months of effort can now be compressed into days.”
The Discourse → HEIF → libheif chain that opened the door
The entry point was OpenAI’s public help forum at community.openai.com, which runs on Discourse. In the affected setup, Discourse typically routed images through a FastImage check, but FastImage did not support HEIF files. HEIF uploads therefore passed through ImageMagick, which invoked libheif to process the files before converting them into another image format.
That processing path “exposed the underlying libheif parser directly to attacker-controlled files,” the researchers wrote, enabling them to trigger the heap buffer overflow in libheif and then escalate to RCE when the exploit was successfully crafted with Claude Opus 5.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildAccount takeover and the measured demonstration of impact
After achieving RCE, the team said they took over multiple OpenAI employees’ ChatGPT accounts. One of those accounts had Codex connected to OpenAI’s GitHub organization. Rather than retrieving internal code, the researchers used the seized Codex connection to send a prompt that opened a pull request in OpenAI’s internal monorepo as a proof-of-access, then stopped further testing.
The timeline in the writeup places the initial entry on July 25 and says the entire chain—from discovery to accessing an OpenAI repository via the pull request—took less than 72 hours. The researchers “immediately” reported the vulnerability to OpenAI after achieving RCE.
OpenAI, Bugcrowd, and Discourse responses
OpenAI fixed the flaw “within about 14 hours of the report’s submission,” marked the issue as resolved, and awarded the Hacktron team $6,500 through OpenAI’s bug bounty program on Bugcrowd, the writeup says. OpenAI also clarified, via a comment shared by Hacktron, that testing against the Discourse-hosted community.openai.com was explicitly excluded from its bug bounty program and that the award “recognizes the OpenAI-side finding, not the actions against Discourse.”
Discourse issued a fix that added image-processing sandboxing and published a security advisory, GHSA-vhm9-85gw-x335, with patching and rebuild guidance. The Register reported that neither OpenAI nor Anthropic responded to requests for comment.
What this means for technologists, enterprises, and end users
- Technologists and security teams: The researchers’ account highlights how AI models can accelerate exploit development from vulnerability discovery to functional RCE. Security teams will need to consider AI-assisted exploit generation when prioritizing patches and when designing image-processing and sandboxing controls.
- Enterprises and procurement leaders: The Hacktron writeup notes the breadth of services a compromised ChatGPT or Codex account can reach, including GitHub, Slack and emails. Organizations that connect code hosts and communication platforms to AI tooling must inventory those connections and assess the risk of account-level compromises.
- End users and forum operators: The researchers’ blunt warning — “Until two months ago, any user or OpenAI employee logging into OpenAI’s own help forum (community.openai.com) could have had their ChatGPT and Codex accounts taken over” — places a spotlight on the security of third-party components (image processors, libraries) used by public forums and help sites.
The episode is a compact case study in how a small set of vulnerabilities, AI-assisted exploit development, and widely connected accounts can combine into rapid, high-impact access. The researchers concluded with a caution: “Security assumptions must catch up with attacker capabilities.” Open questions that remain in the record are who outside the immediate parties has adjusted controls and how other services that process HEIF or similar formats have reacted — but the immediate fixes by OpenAI and Discourse show the vulnerability chain can be closed when reported and acted on.
