A security investigation that began with an image uploaded to OpenAI’s public community forum ended inside the company’s private GitHub environment less than 72 hours later.
The researchers behind the work were not criminals, and they did not secretly raid OpenAI’s systems. They were Hacktron AI, a security research group working through OpenAI’s official bug bounty program.
What makes their findings unusual is not simply how far they managed to get. It is what helped them get there.
According to the researchers, a newer version of Anthropic’s Claude model helped turn a previously unresolved memory-corruption bug into a working exploit within hours. That exploit became the first step in a three-part vulnerability chain that ultimately gave the researchers access to an OpenAI employee account and, through it, OpenAI’s internal GitHub organization.
Rather than inspect private source code, the team said it demonstrated its access by creating a harmless pull request.
The episode offers a striking glimpse of two security problems developing at the same time: increasingly capable AI systems are making technically difficult exploit development faster, while deeply connected workplace accounts can allow a compromise in one service to spread far beyond its original boundaries.
The attack began with an image
The starting point was OpenAI’s community forum.
The forum runs on Discourse, which relies on ImageMagick for processing images and files uploaded by users. Inside that image-processing chain, Hacktron AI identified a flaw involving libheif, a component used to handle HEIC images.
The researchers found a way to trigger a heap buffer overflow using a specially crafted image.
A heap buffer overflow occurs when software writes data outside an allocated section of memory. Under the right conditions, this kind of vulnerability can be developed into an exploit that allows an attacker to execute code on the affected system.
In this case, the flaw gave the researchers their first foothold on the forum’s backend.
That alone would have been a significant security finding. But it was only the beginning.
One foothold opened the door to an employee account
After gaining access to the forum environment, the researchers found a second weakness involving OpenAI’s identity and sign-in setup.
That issue allowed them to move beyond the community forum and gain control of an actual OpenAI employee’s ChatGPT and Codex accounts.
The significance of that access came from what was connected to the employee identity.
The account carried permissions linked to workplace services including GitHub, Slack, Outlook, Gmail and Google Drive. Once the researchers inherited those permissions, the original forum vulnerability was no longer confined to a public-facing community service.
It had become a route into internal company systems.
From there, Hacktron AI reached OpenAI’s private GitHub organization and its main code repository.
The researchers said they deliberately avoided examining sensitive code. Instead, they created a harmless pull request to demonstrate that their access was real without unnecessarily interacting with private material.
Claude solved the part that had previously stalled
The vulnerability chain is notable on its own, but the role of AI in developing the exploit is what makes the case particularly significant.
Hacktron AI had reportedly identified the underlying memory-corruption bug earlier while using an older Anthropic model, Claude Opus 4.8.
At that stage, the researchers could not turn the bug into a working exploit.
The problem remained unresolved until late July, when Anthropic released Claude Opus 5.
The researchers gave the newer model the same problem.
According to their account, Claude Opus 5 produced a working exploit for ARM64 systems within hours. It was then able to adapt the exploit across different computer architectures.
That kind of work traditionally demands deep knowledge of operating systems, memory management, low-level programming and processor architecture. In this case, the newer AI model reportedly helped compress part of that process into a matter of hours.
Once the exploit worked, the rest of the security investigation moved quickly.
From the first successful exploit to access inside OpenAI’s private repository, the entire chain took less than 72 hours.
Anthropic’s AI ended up assisting research against a major rival
There is another layer to the story that is difficult to ignore.
Anthropic and OpenAI are direct competitors in the development of advanced AI systems. Yet in this case, Anthropic’s Claude was reportedly the tool that helped security researchers overcome a technical obstacle while testing the security of OpenAI’s infrastructure.
That does not mean Anthropic participated in or directed the research. The model was simply the tool being used by the researchers.
But the circumstances underline how general-purpose AI systems can cross traditional competitive boundaries. A model created by one AI company can be used to test, analyze or potentially attack systems belonging to another.
For defensive security teams, that can be valuable.
The same capability also raises a harder question: what happens when similar tools are used by people who have no intention of reporting the vulnerabilities they find?
OpenAI fixed the issue after disclosure
Hacktron AI reported the vulnerability chain to OpenAI through the company’s Bugcrowd bug bounty program on July 25, 2026.
OpenAI confirmed that the underlying vulnerability was fixed the same day it was reported.
The company also said it narrowed the permissions granted to community sign-in tokens and revoked affected tokens and active sessions.
Hacktron AI received a $6,500 bounty for the disclosure.
The research was conducted as authorized security testing, and there is no indication in the information provided that the researchers used their access to steal private source code or cause damage.
Their decision to create a harmless pull request instead of browsing sensitive repository contents was intended to establish proof of access without going further than necessary.
A bigger lesson about AI-assisted hacking
The most important part of the episode may not be the individual vulnerabilities.
Software flaws are regularly discovered in large technology platforms, and bug bounty programs exist specifically to encourage researchers to report them responsibly before malicious actors can take advantage.
What stands out here is how quickly the technical barrier changed.
The researchers had already encountered the underlying bug with an earlier AI model, but they could not develop a usable exploit from it.
After a more capable model became available, the same problem was reportedly solved within hours.
That difference matters because exploit development has historically been constrained by expertise. Discovering a memory bug is one skill. Turning it into reliable code execution, particularly across different processor architectures, can require considerably more specialized knowledge.
If increasingly capable AI systems can assist with those steps, advanced vulnerability research could become accessible to a much larger group of people.
That can benefit defenders searching for bugs before attackers find them.
It can also reduce the amount of expertise and time required by attackers trying to do the opposite.
The other weakness was not software, but connectivity
The incident also shows why companies increasingly have to think about identity systems as part of their security perimeter.
The initial vulnerability affected a community forum.
The eventual access extended to internal source code.
The bridge between the two was an employee identity connected to multiple workplace platforms.
GitHub, Slack, Outlook, Gmail, Google Drive, ChatGPT and Codex can each be useful parts of a modern working environment. Connecting them through common identities and shared permissions can make employees considerably more productive.
It can also increase the consequences when one of those identities is compromised.
In this case, a vulnerability involving an image-processing component eventually became relevant to a private code repository because several separate weaknesses could be combined.
That chain is perhaps the clearest lesson from the research.
A vulnerability does not always need to be catastrophic on its own. Three problems that appear manageable in isolation can become something very different when an attacker discovers how they fit together.
And increasingly, AI may be helping researchers find those connections much faster.
Also Read: Why Nicky Hager Called His New Book ‘Dirty Work’ and Why the Taxpayers’ Union Is at the Centre of It
