Researchers used Claude to hack into OpenAI's own repos in 72 hours

Security firm Hacktron AI disclosed that it chained a heap-overflow bug in the libheif image library with an SSO misconfiguration in OpenAI's community forum to gain remote code execution, hijack an employee's ChatGPT and Codex accounts, and reach OpenAI's internal GitHub monorepo. The bug chain itself wasn't the novel part — the exploit author was. When Claude Opus 4.8 stalled against the target's ASLR protections, the team switched to the newly released Claude Opus 5, which produced a working ARM64 exploit in about three hours and then ported it to x86-64 largely on its own. Start to finish — first foothold to demonstrated access inside OpenAI's monorepo — took under 72 hours. Hacktron disclosed responsibly through Bugcrowd and Discourse's HackerOne program; both parties patched within days and OpenAI paid a $6,500 bounty. It's a concrete data point for how fast frontier coding models can now automate real offensive-security work, and a reminder that a single support-forum authentication gap can undercut an otherwise well-defended stack.

This is a summary by our content curator. Read the original at Hacktron AI: https://www.hacktron.ai/blog/hacking-openai.