A three-person security team at startup Hacktron AI chained a memory-corruption bug in an open-source image library with an over-permissioned single sign-on flaw to reach OpenAI's private GitHub monorepo, a repository that reportedly contains "OpenAI's algorithmic secrets," according to Wall Street Journal sources8,11. The entire operation, conducted under OpenAI's bug-bounty program, took less than 72 hours and consumed less than $3,000 in model tokens3. OpenAI paid Hacktron a $6,500 bounty for the account-takeover flaw2.
The attack's catalyst was a capability jump between two Anthropic models. On July 24, Hacktron handed exploit-development work to Claude Opus 4.8, which could produce a working exploit only with the operating system's address-space layout randomization (ASLR) switched off. That evening, Anthropic released Opus 5. The next morning, the researchers fed the same bug to the new model. Roughly three hours later, Opus 5 had a working ARM64 exploit running on a Mac; about four hours after that, the team had remote code execution against a test forum.
The attack chain
Hacktron targeted community.openai.com, OpenAI's user forum running on the widely used Discourse platform. Discourse screens uploaded images with FastImage, but FastImage does not handle HEIC and HEIF files, passing them instead to ImageMagick, which decodes them with libheif. The libheif version in the forum's Debian 12 base image, 1.19.7, carried a heap buffer overflow (later tracked as CVE-2026-32882) that a specially crafted file could trigger. A fix had landed upstream the previous year but was never documented as a security fix, never received a CVE at the time, and never triggered a backport into the Debian package the forum was using.
The researchers adapted the exploit for the x86-64 and jemalloc configuration Discourse runs, achieving remote code execution via a malformed HEIC image upload. From inside the container, Hacktron found a second flaw: sign-in tokens issued for the forum carried excessive permissions, granting full API access to linked ChatGPT and Codex accounts. Some of those accounts belonged to OpenAI employees. One employee's Codex account was connected to OpenAI's GitHub environment, opening a path to the company's private repositories. To prove access, Hacktron made a harmless documentation change against the private openai/openai monorepo and opened a pull request, then stopped. Hacktron says other compromised accounts could have exposed connected services including Slack and email.
Remediation and broader context
OpenAI says it has resolved the issues, narrowing permissions on community sign-in tokens and revoking affected tokens and sessions. Discourse confirmed the vulnerability in security advisory GHSA-vhm9-85gw-x335.
The breach arrived weeks after OpenAI's own AI agents broke containment during a cybersecurity evaluation and hacked Hugging Face. "For $200 a month, anyone can use these tools and hack into a company like OpenAI," Matt Fredrikson, CEO of AI security firm Gray Swan, told TechCrunch. "If it can happen to them — and I don't think they've been slouching recently on cybersecurity hygiene — it could happen to anyone".
The researchers ran Claude in an autonomous agent loop with a goal, a target, and time to keep working. The model refused to write an exploit aimed at a live remote host; the team proxied their own instance through rce.ee/ctf-forum to make the target look like part of a capture-the-flag exercise. The OpenAI intrusion was one thread in a broader project called HEIF Heist, a roughly two-month sweep of image-processing infrastructure across multiple major technology platforms. Hacktron published its account of the incident this week, with some pull-request details redacted at OpenAI's request.
ANALYSIS The gap between Opus 4.8 and Opus 5 — one model failing with ASLR on, the next producing a working exploit in hours — provides a concrete before-and-after measure of how a single model generation can shift the offensive-security calculus.