White-Hat Researchers Use Anthropic's Claude Opus 5 to Breach OpenAI's Internal GitHub Environment

Hacktron AI, a security research startup, said it used Anthropic's newly released Claude Opus 5 model to turn an image-processing vulnerability into an exploit chain that compromised an OpenAI employee's ChatGPT account and reached OpenAI's internal GitHub environment. The findings were reported to OpenAI and Discourse in July and independently covered by The Wall Street Journal.

The initial entry point was OpenAI's community forum, which runs on Discourse. According to the researchers, HEIC and HEIF images uploaded to the forum were passed through ImageMagick and decoded with libheif, where a heap buffer overflow could be developed into remote code execution. Discourse confirmed the vulnerability in a July 28 security advisory, assigning a CVSS score of 8.8, and said it had patched affected releases. Hacktron also said it found a separate flaw in OpenAI's single sign-on implementation that allowed the forum compromise to be escalated into access to ChatGPT and Codex accounts of users, including OpenAI employees.

The researchers said they did not examine sensitive source code. Instead, they used the compromised employee account's access to Codex to create a harmless pull request in OpenAI's internal openai/openai monorepo as proof of the access level. Hacktron said it had initially used Claude Opus 4.8 to investigate the vulnerable libheif package, but the model struggled to make the exploit reliable with address-space layout randomization enabled. After switching to Claude Opus 5, released by Anthropic on July 24, the model produced a working ARM64 exploit within hours, which was then adapted to the x86-64 and jemalloc environment used by Discourse. The full path from discovery to access to OpenAI's repository environment took less than 72 hours.

Hacktron said it reported the findings through OpenAI's Bugcrowd program on July 25, and OpenAI confirmed the same day that its side of the vulnerability had been fixed. OpenAI reportedly paid the researchers $6,500, while testing against the Discourse-hosted community site was outside the bounty scope.