Claude helped hackers to break into OpenAI accounts: ChatGPT affected
Emails, Slack, and GitHub may have been accessed.
Image by NurPhoto via Getty Images
- Hacktron AI researchers say they exploited two flaws in OpenAI’s community forum in under 72 hours.
- A malicious image upload let the researchers run code on the forum server.
- They say compromised accounts could reach linked ChatGPT, Codex, GitHub, Slack, and email services.
- OpenAI fixed its issue in about 14 hours and awarded the researchers a $6,500 bounty.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
Researchers say they used Anthropic's Claude AI to exploit 2 vulnerabilities that allowed them to take over OpenAI employee accounts and reach connected services such as Outlook, Slack, GitHub, and an internal OpenAI code repository.
Three researchers from Hacktron AI, Harsh Jaiswal, Mohan Pedhapati, and Rahul Maini, said the attack took less than 72 hours from their initial discovery to the demonstration of access to OpenAI's internal repository.
“On July 25th, we hacked OpenAI,” said the researchers on an X post.
“It took us less than 72 hours.”
Researchers targeted OpenAI’s community site (community.openai.com). The forum platform is powered by Discourse, an open-source internet forum system, and allows users to sign in with their OpenAI accounts.
“Until 2 months ago, any user or OpenAI employee logging into OpenAI’s own help forum could have had their ChatGPT and Codex accounts taken over,” they said in a report published on Hacktron AI's website.
“Since people can connect various services to Codex and ChatGPT, the scope of what we could theoretically access was huge, including GitHub, Slack, and emails,” they added.
On July 25, we hacked OpenAI.
undefined s1r1us (@S1r1u5_) September 18, 2026
Two bugs let us take over ChatGPT/Codex accounts of OpenAI employees (+some unaffiliated users) and reach connected services: Outlook, Slack, GitHub, etc.
We proved it with a PR in OpenAI’s internal codebase . It took us <72h. 🧵 pic.twitter.com/gVsmQZwSc8
This may have resulted in the leak of user files from multiple accounts, potentially containing sensitive information.Image upload was vulnerable to the exploit
The Hacktron researchers suspected that compromising the forum could therefore create a path into other OpenAI services through the company's single sign-on system. They discovered a vulnerability in the way a forum processes image upload – HEIC and HEIF image formats.
Discourse normally uses FastImage to inspect uploaded images. Because FastImage did not support HEIF, however, those files were passed to ImageMagick for conversion, exposing the underlying libheif image parser to potentially malicious files.
The researchers found a heap buffer overflow in the version of libheif used by the Discourse Docker image. They said the flaw could provide the memory read and write capabilities needed to turn a malicious image into remote code execution.
Stay updated with our latest stories and follow us on social media
Be the first to discover new stories, ideas, and updates from our team.
Claude helped to create the exploit
On July 24th, the researchers used Claude Opus 4.8 to develop a working exploit for the discovered vulnerabilities. However, the attempt was unsuccessful.
After Anthropic released Claude Opus 5, researchers tried again, this time succeeding. Within 3 hours, it produced a working ARM64 exploit for a local Mac.
Then they asked Claude to adapt to the x86-64 environment and jemalloc configuration used by Discourse.
On July 25th, the researchers said they had confirmed remote code execution through an image upload. They then tested the exploit on their own Discourse Cloud instance before using it against OpenAI's forum.
According to Hacktron, Claude was able to achieve remote code execution on the test environment and demonstrate access to the system.
“When code execution landed inside a sandbox or restricted environment, the models also helped with privilege escalation, lateral movement, and bypassing existing defenses,” the researchers said.
After that, the researchers used the exploit against OpenAI's instance.
The entire research project cost less than $3,000 in tokens.
“This was not completely autonomous hacking, and skilled human guidance remained important, but the amount of work a small team could perform increased dramatically,” they explained.
They took over ChatGPT accounts
The researchers said they discovered that OpenAI's single sign-on setup created a separate path from the compromised forum into ChatGPT and Codex accounts.
Once they had compromised the forum, they said they could take over active members' ChatGPT and Codex accounts. The compromised employee's Codex account was connected to OpenAI's GitHub. The researchers instructed Codex to create a pull request in OpenAI's internal monorepo, which stores source code.
The connected accounts could have provided access to services such as GitHub, Slack, and email, depending on which individual users had linked to their ChatGPT or Codex accounts.
Researchers emphasized in the report that they did not use the access to obtain sensitive information.
After discovering the vulnerability, the researchers disclosed it to OpenAI and Discourse.
According to the report, OpenAI fixed its side of the issue within roughly 14 hours and later awarded the researchers a $6,500 bounty. Discourse prepared a fix within days and added additional sandboxing around image processing.