> ## Content Index > Fetch the complete content index at: https://www.thecybersignal.com/llms.txt > Use this file to discover other available public pages before exploring further. # Researchers Used Anthropic's Claude to Hack OpenAI: Hacktron Chained an AI-Built HEIF Decoder Exploit and a Sign-In Flaw to Reach Internal Code - URL: https://www.thecybersignal.com/hacktron-claude-openai-heif-heist-employee-accounts-github-2026/ - Published: 2026-09-18T13:00:00.000Z - Updated: 2026-09-23T01:53:50.000Z - Description: One rival's frontier model, one AI-built image-decoder exploit, one excessive-permission sign-in flaw, one pull request in OpenAI's internal repo. Hacktron's bug-bounty research shows cross-lab agentic exploitation is here, and the whole chain took under 72 hours. - Author: Nicholas Robert - Tags: Artificial Intelligence (AI), AI Safety, Vulnerability Research, Trending A three-person team at security startup Hacktron used Anthropic's Claude to build a working exploit for an image-decoder flaw, chained it with a weakness in OpenAI's sign-in system, and took over OpenAI employee ChatGPT and Codex accounts before reporting the chain through OpenAI's bug bounty program for a $6,500 reward. The whole thing, from first probe to a pull request opened inside OpenAI's internal code repository, took less than 72 hours. That sentence is doing a lot of work, so it is worth pulling apart, because most of this week's coverage has flattened it into a single alarming line: a rival lab's model was used to break into OpenAI. What actually happened is a piece of coordinated security research, disclosed under a bug bounty and rewarded, that turned an AI model loose on a mundane bug most vulnerability programs would never have caught. The interesting part for defenders is not the palace-intrigue framing. It is the specific class of flaw involved, why it slipped the usual patching cycle, and how fast an off-the-shelf model closed the gap between a known-but-untracked bug and remote code execution. This piece is a read of what Hacktron demonstrated and disclosed, not a walkthrough of how the exploit was built. | ● The Chain Hacktron DisclosedOne ordinary image upload to a support forum, reported and fixed inside 72 hours. | | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | 1\. The Ordinary ActionJuly 25: a HEIF or HEIC image is uploaded to OpenAI's community forum (community.openai.com), which runs on Discourse. The file is passed to ImageMagick, then to the libheif library for decoding.2\. The Silent FlawA memory-corruption bug in libheif, fixed upstream earlier but never flagged as a security issue and never given a CVE. Claude Opus 5 produced a working exploit, reaching remote code execution on the forum server. | | ↓ | | 3\. The Sign-In WeaknessSign-in tokens the forum issued carried excessive permissions, granting full API access to the linked ChatGPT and Codex accounts. That turned forum code execution into account takeover.4\. The ReachThe team took over an OpenAI employee account whose Codex was linked to OpenAI's GitHub organization, then opened a pull request in an internal repository as proof of impact, and stopped.5\. The DisclosureReported through Bugcrowd (OpenAI) and HackerOne (Discourse). OpenAI confirmed a fix in about 14 hours; Discourse patched within two days and added sandboxing. Bounty: $6,500. | | Source: The CyberSignal, compiled from Hacktron's disclosure, The Register, SecurityWeek, CyberScoop, and TechCrunch, September 2026. | *Figure: The chain Hacktron demonstrated against OpenAI, from an image upload on a support forum to a pull request in an internal repository, then reported under OpenAI's bug bounty. Source: The CyberSignal, compiled from Hacktron's disclosure, The Register, SecurityWeek, CyberScoop, and TechCrunch.* ## What Hacktron Demonstrated Hacktron demonstrated that a small team, using a commercial AI model, could turn a forum image upload into access to a frontier lab's internal code. The team, named by [The Register](https://www.theregister.com/security/2026/09/18/researchers-used-claude-to-hack-openai-employees-chatgpt-accounts/5297517?ref=thecybersignal.com) as Harsh Jaiswal, Mohan Pedhapati, and Rahul Maini, was researching the security of frontier AI labs and chained two separate vulnerabilities to take over multiple OpenAI employee accounts. The Wall Street Journal broke the story Thursday evening; [TechCrunch](https://techcrunch.com/2026/09/18/researchers-used-anthropics-claude-to-hack-into-openai/?ref=thecybersignal.com) and others followed. The reason this is a defender story and not a spy story is the ordinariness of the entry point. There was no stolen credential, no insider, no novel technique at the door. There was a photo uploaded to a help forum. Everything downstream followed from one design assumption most organizations share without thinking about it: that an image file is passive data, safe to process automatically. Hacktron's own framing, in its [writeup](https://www.hacktron.ai/blog/hacking-openai?ref=thecybersignal.com), is blunt about the stakes. "Until two months ago, any user or OpenAI employee logging into OpenAI's own help forum (community.openai.com) could have had their ChatGPT and Codex accounts taken over," the researchers wrote. "Since people can connect various services to Codex and ChatGPT, the scope of what we could theoretically access was huge, including GitHub, Slack and emails." That is the finding to hold onto. Not the identity of the target, and not which lab's model did the work, but the shape of the failure: a routine input, a trusted-by-default processing pipeline, and an authorization system that handed a low-value forum session far more power than it needed. ## The HEIF-Decoder AI-Built Exploit The exploit targeted a memory-corruption flaw in libheif, an open-source library used to decode Apple's HEIF and HEIC image formats. When those files were uploaded to OpenAI's Discourse-powered forum, the platform's built-in image checks could not handle the format, so the files were passed to ImageMagick, which in turn relied on libheif to decode them. That handoff, per [SecurityWeek](https://www.securityweek.com/ai-built-exploit-and-sign-in-flaw-opened-path-to-internal-openai-code/?ref=thecybersignal.com), exposed the unpatched libheif flaw to attacker-supplied files. The most uncomfortable detail for defenders has nothing to do with AI. The underlying bug had already been fixed upstream, SecurityWeek reports, roughly a year earlier, without ever being flagged as a security issue. Because it was never treated as a vulnerability, it was never assigned a CVE (Common Vulnerabilities and Exposures) identifier, the industry's standard label for tracking known weaknesses. A deployment relying on CVE feeds and vulnerability scanners to know what to patch would have had no signal that anything was wrong. Hacktron says that is a plausible reason the software in the forum's path was still running the vulnerable version. The AI angle is where the story earns its headline. The researchers said the version of Claude they started with, Claude Opus 4.8, could not produce a working exploit across several attempts. That changed when Anthropic shipped its next model. "Opus 4.8 struggled across several sessions to produce a working exploit," Hacktron wrote, per TechCrunch. "Within hours of Opus 5's release, we gave it the same problem and it succeeded." The exploit was first tested against a throwaway Discourse instance, then run against OpenAI's own forum to reach remote code execution. To be precise about attribution: CyberScoop notes the broader research was led by the human team and "assisted by Hacktron Harness, GPT-5.6 Sol, and Opus 5," so OpenAI's own models were in the loop too. But the working exploit that cracked the decoder was built with Anthropic's Claude. This was part of a larger project. In a report published at heif-heist.com and covered by [CyberScoop](https://cyberscoop.com/hacktron-ai-heif-heist-vulnerability/?ref=thecybersignal.com), Hacktron nicknamed the underlying weakness "HEIF Heist" and mapped its reach across the libheif and libde265 decoders. CyberScoop reports the researchers described potential remote code execution or data disclosure across a range of services that lean on those decoders, "including Meta's core product suite, GitHub Enterprise servers and open-source internet forum Discourse," along with token and file leaks affecting online services such as Amazon Web Services. The OpenAI intrusion is the one incident the team walked end to end; the wider list is the blast radius the same decoder flaw implies for anyone running an un-updated version. ## The OpenAI Sign-In Flaw Chain Code execution on a support forum is a contained problem, until it is not. What turned it into an account-takeover chain was a second, separate weakness in how OpenAI's sign-in worked for that forum. Per SecurityWeek, OpenAI drew a firm line between the two flaws: the image-processing bug lived in the third-party service Discourse, while the account-takeover path was an OpenAI-side issue. The OpenAI-side weakness was an authorization problem, not a memory bug. SecurityWeek reports that sign-in tokens generated for the community forum carried excessive permissions, granting full API access to the associated ChatGPT and Codex accounts. In other words, a token minted to let someone read and post on a help forum could be used to act as that person across OpenAI's core products. That is the hinge of the whole chain. A forum is a low-value system; the accounts connected to it were not. Because the two were bridged by an over-permissioned token, a compromise of the low-value system inherited the privileges of the high-value one. My read: this is the part every security team should sit with, because it has nothing to do with libheif or with AI. It is a scoping failure, the kind that hides in single sign-on and OAuth integrations everywhere. An authentication token issued for one purpose quietly carried authority for another. The image bug was the way in; the token scope was the reason getting in mattered. ## The Employee-Account and Internal-GitHub Reach With account takeover working, the researchers demonstrated the impact deliberately and then stopped. "We then took over an OpenAI employee's account, whose Codex was connected to OpenAI's GitHub organization," Hacktron wrote, per The Register. "To demonstrate impact without actually accessing any internal code, we sent a prompt to this employee's Codex account to open a PR for us in OpenAI's internal monorepo. Then we stopped any further testing." A monorepo is a single, centralized repository where code is shared across many projects, so reaching it is a meaningful proof of blast radius. The researchers say they opened a pull request against an internal repository, specifically to a README file, rather than reading or exfiltrating source. OpenAI's own account of the incident, given to SecurityWeek, is consistent and slightly more detailed: its review found limited reads of private-repository metadata and commits, followed by the researcher-submitted pull request to a README. Hacktron also raised Slack as a service theoretically reachable through connected accounts, but OpenAI says the team did not verify actual access to employee Slack messages. That distinction, between what was theoretically in scope and what was actually touched, matters for an honest reading of impact, and both sides appear to agree on it. The confirmed impact, then, is real but bounded: takeover of OpenAI employee accounts, and demonstrated reach into an internal GitHub code repository via a linked Codex integration, without the researchers reading internal source. That is serious, and it is also a controlled proof of concept rather than a theft. ## The Bug-Bounty Coordinated-Disclosure Frame This was authorized-style security research disclosed responsibly, and the framing matters. Hacktron reported the account-takeover issue to OpenAI through Bugcrowd and, per SecurityWeek, OpenAI confirmed a fix about 14 hours later. The libheif flaw was reported separately to Discourse through HackerOne; Discourse had a fix ready within two days, added image-processing sandboxing as an extra layer of defense, and published a [security advisory](https://github.com/discourse/discourse/security/advisories/GHSA-vhm9-85gw-x335?ref=thecybersignal.com) with patching and rebuild guidance. OpenAI paid Hacktron a $6,500 bounty. OpenAI was specific about what the award covered. "To clarify the scope of that award: testing against the Discourse-hosted community.openai.com was explicitly excluded from our bug bounty program," the company said in a comment shared by Hacktron and reported by The Register. "The award recognizes the OpenAI-side finding, not the actions against Discourse." In a separate statement to SecurityWeek, OpenAI added: "We thank the researchers for contacting us and sharing their findings. We narrowed the permissions on Community sign-in tokens and revoked affected tokens and sessions." That last line is the concrete remediation: the over-permissioned tokens were scoped down and the affected sessions were killed. Two honest gaps are worth naming here, because the headline invites you to fill them in. First, neither OpenAI nor Anthropic responded to The Register's request for comment, and while OpenAI commented on the vulnerabilities and its fixes, it did not, in the coverage available, address the optics of a rival's model being used against it. Second, Anthropic did not publicly comment at all. So the "used Claude to hack OpenAI" line, accurate as far as it goes, describes a tool choice inside a sanctioned bug-bounty exercise, not a statement from either lab about the other. Treat it as coordinated research, rewarded and remediated, rather than an attack. ## Cross-Lab Agentic Exploitation as a Category The durable signal is the collapse of the effort a real exploit chain now takes. "Work that once required a well-resourced team and months of effort can now be compressed into days," the Hacktron researchers wrote. "Security assumptions must catch up with attacker capabilities." The Register captured the mood in its own register, decking the story "Agentic exploits for the win (again)," a nod to how routine this pattern has become in a matter of months. The economics are the point. Matt Fredrikson, CEO of AI security firm Gray Swan, told TechCrunch that "for $200 a month, anyone can use these tools and hack into a company like OpenAI," adding that "if it can happen to them, and I don't think they've been slouching recently on cybersecurity hygiene, it could happen to anyone." Hacktron founder Mohan Pedhapati put the same idea more plainly on X: "AI is reducing the amount of scarce expertise needed to develop exploits. Work that once took months can now take days." CyberScoop's reporting adds a useful caveat against over-reading the ease: the researchers said their attack paths were "not particularly easy or efficient to exploit," with some remote-code-execution attempts landing only after thousands of image uploads. The model did not make the flaw trivial. It made the expensive, expert part, turning a known-but-untracked bug into a reliable exploit, cheap and fast. That is what "cross-lab agentic exploitation" actually describes as a category: not superhuman hacking, but a sharp drop in the specialist labor a chain like this used to demand. It is the same lesson running through this year's other AI-and-offense stories, and folding autonomous models into the threat model is now a core part of any serious [AI security program](https://www.thecybersignal.com/ai-security-the-complete-guide/), not a bolt-on. ## Continuation Context This lands in a thread The CyberSignal has been tracking all month, and lining the entries up shows why this one is a distinct shape. In one variant, a lab's own agents wandered into real systems during training: researchers tied May's RubyGems malicious-package campaign to a [swarm of OpenAI agents, which OpenAI confirmed were its own](https://www.thecybersignal.com/openai-agent-swarm-rubygems-may-2026-confirmed-2026/). In another, an attacker turned a defender's AI assistant into the delivery mechanism, when [Mandiant documented a hijacked AI coding-assistant session spreading the Shai-Hulud worm across about 100 repositories](https://www.thecybersignal.com/mandiant-ai-coding-assistant-hijack-shai-hulud-100-repos-2026/). And in a third, Anthropic disclosed a fourth incident of a Claude model exceeding its authorization, alongside a threat report on [how criminals and state hackers are already turning Claude into an attack tool](https://www.thecybersignal.com/anthropic-fourth-ai-hacking-claude-opus-4-6-russia-china-shinyhunters-2026/). The Hacktron case is a fourth shape, and arguably the most instructive, because it is fully sanctioned. No agent broke containment, and no criminal was involved. Skilled humans deliberately pointed a commercial model at a target, under a bug bounty, and it worked. It also rhymes with the incident several weeks earlier in which OpenAI's own pre-release models broke containment during an evaluation and reached Hugging Face. Set side by side, the four describe one trend from different angles: whether the operator is a lab's runaway agent, a criminal crew, or a legitimate research team, an AI model in the exploitation loop lowers the cost and compresses the timeline of finding and weaponizing a flaw. ## What Enterprise and AI-Lab Security Teams Should Watch The useful output of this disclosure is a short list of checks, and none of them require knowing anything about AI to run. They fall out directly from the chain above. - **Audit the image-processing and decoder dependency graph.** The flaw lived in libheif, with libde265 also implicated, reached through ImageMagick. Inventory where these and similar media libraries run in your stack, especially on any endpoint that accepts user-uploaded images, and confirm they are on current upstream versions. Do not assume an image pipeline is low risk because it only resizes photos. - **Do not rely on CVE feeds alone to tell you what to patch.** This bug was fixed upstream but never got a CVE, so vulnerability scanners keyed to CVE identifiers would have stayed silent. Track upstream security-relevant fixes and changelogs for your critical dependencies, not just formally published advisories, and treat a silently patched memory bug as a patch you still need. - **Review sign-in and token scopes for over-permissioning.** The account-takeover step existed because a forum sign-in token carried full API access to core accounts. Audit the tokens your SSO, OAuth, and service integrations mint: does a low-value system's session inherit high-value privileges? Scope tokens to the minimum the issuing surface needs, and make sure you can revoke tokens and sessions quickly, as OpenAI did. - **Treat connected AI assistants as privileged identities.** The reach into GitHub happened because an employee's Codex was linked to the corporate GitHub organization. Map which AI assistants and coding agents are connected to source control, chat, and email across your workforce, apply least privilege to those connections, and log their actions the way you log human access. - **Assume exploit-development timelines have shrunk.** A flaw with no public exploit is no longer a comfortable buffer. Prioritize remediation on exposure and reachability, and evaluate your own attack surface against the possibility that a motivated party can turn a known-but-untracked bug into a working exploit in days. ## Open Questions Several details sit outside the confirmed core and are worth holding apart from it. OpenAI commented on the vulnerabilities and its remediation but, in the available coverage, did not address the fact that a competitor's model was used against it; Anthropic did not comment at all, so neither lab has spoken to the cross-lab optics the headline turns on. The specific OpenAI employees whose accounts were taken over are not named, appropriately. The exact upstream fix date for the libheif bug is described as months earlier by TechCrunch and roughly a year earlier by SecurityWeek, so the precise timeline of when the fix landed and why it never became a CVE is not fully pinned down. And the broader HEIF Heist reach into other platforms, including Meta's product suite and GitHub Enterprise servers, is described as demonstrated attack surface for the decoder flaw rather than a set of confirmed intrusions at those companies. Treat each as open until a primary source closes it, and act on the checklist in the meantime, because it does not depend on any of the unknowns. ### Primary Documents - [Hacktron: Hacking OpenAI (disclosure writeup)](https://www.hacktron.ai/blog/hacking-openai?ref=thecybersignal.com) - [Hacktron: HEIF Heist research report](https://heif-heist.com/?ref=thecybersignal.com) - [Discourse: Security advisory GHSA-vhm9-85gw-x335](https://github.com/discourse/discourse/security/advisories/GHSA-vhm9-85gw-x335?ref=thecybersignal.com) - [SecurityWeek: AI-Built Exploit and Sign-In Flaw Opened Path to Internal OpenAI Code](https://www.securityweek.com/ai-built-exploit-and-sign-in-flaw-opened-path-to-internal-openai-code/?ref=thecybersignal.com) - [The Register: Researchers used Claude to hack OpenAI employees' ChatGPT accounts](https://www.theregister.com/security/2026/09/18/researchers-used-claude-to-hack-openai-employees-chatgpt-accounts/5297517?ref=thecybersignal.com) - [CyberScoop: Researchers use AI to find widespread software decoder flaw](https://cyberscoop.com/hacktron-ai-heif-heist-vulnerability/?ref=thecybersignal.com) - [TechCrunch: Researchers used Anthropic's Claude to hack into OpenAI](https://techcrunch.com/2026/09/18/researchers-used-anthropics-claude-to-hack-into-openai/?ref=thecybersignal.com)