Claude Helped Hack OpenAI: How Researchers Breached Its Systems and Earned $6,500

Security researchers used Anthropic’s Claude AI to hack OpenAI’s infrastructure, gain access to employee ChatGPT and Codex accounts, and demonstrate access to an internal GitHub repository. The investigation, conducted by cybersecurity startup Hacktron AI, took less than 72 hours and resulted in a $6,500 bug bounty from OpenAI.

The incident occurred on July 25, 2026, but received widespread international media attention in September. Researchers exploited an image-processing vulnerability in OpenAI’s community forum and combined it with a single sign-on (SSO) misconfiguration to access connected employee accounts.

OpenAI and Discourse have since resolved the reported vulnerabilities.

The case highlights a growing challenge in AI cybersecurity: advanced AI models can accelerate vulnerability discovery and exploit development, allowing small research teams to investigate complex security weaknesses much faster than before.

Key Takeaways

• Target: OpenAI’s community forum and connected employee accounts.
• Research team: Hacktron AI.
• AI tools: Anthropic’s Claude models, alongside other AI-assisted research tools.
• Initial vulnerability: A flaw in the libheif image-processing library.
• Additional weakness: OpenAI’s single sign-on configuration.
• Demonstrated impact: Access to employee ChatGPT and Codex accounts and the ability to create a proof-of-concept pull request in an internal repository.
• Research timeline: Less than 72 hours.
• Bug bounty: $6,500.
• Current status: OpenAI and Discourse have addressed the reported issues.

What Happened? Researchers Used Claude to Hack OpenAI

A three-person cybersecurity research team from Hacktron AI discovered a chain of vulnerabilities affecting OpenAI’s community forum and connected authentication infrastructure.

The researchers were Harsh Jaiswal, Mohan Pedhapati, and Rahul Maini.

Instead of attacking OpenAI’s core AI models directly, the team investigated its public-facing community forum, which runs on Discourse, an open-source discussion platform.

They discovered that the forum’s image-processing environment included a vulnerable version of the libheif library.

The vulnerability could allow a specially crafted image to trigger remote code execution on the affected server.

After exploiting this initial weakness, the researchers identified another security issue involving OpenAI’s single sign-on configuration.

Combining the two vulnerabilities allowed them to demonstrate access to employee ChatGPT and Codex accounts.

One affected employee account was connected to OpenAI’s GitHub organization. The researchers used that connection to create a harmless proof-of-concept pull request in an internal repository.

They then stopped further testing and reported their findings.

According to Hacktron AI’s original security research, the researchers deliberately avoided reading sensitive internal source code.

How Did Claude Help Researchers Hack OpenAI?

The investigation involved several technical stages. Each vulnerability contributed to a broader security problem, demonstrating how weaknesses in connected systems can increase the impact of an initial compromise.

1. Discovering the Image-Processing Vulnerability

The researchers began by examining how OpenAI’s community forum processed uploaded images.

The forum supported HEIC and HEIF files, image formats commonly associated with Apple devices.

When users uploaded these files, Discourse passed them through ImageMagick for conversion.

ImageMagick relied on another library, libheif, to decode the image data.

The researchers discovered that the installed libheif version contained a memory-management vulnerability.

This weakness created an opportunity for remote code execution when the system processed a specially crafted image.

The discovery was significant because image processing is often considered routine website functionality.

However, a vulnerable library can introduce serious security risks even when the main application appears properly configured.

2. Using Claude to Develop a Working Exploit

After identifying the vulnerability, the research team used Anthropic’s Claude models to assist with exploit development.

According to Hacktron, Claude Opus 4.8 helped identify the issue but initially struggled to produce a reliable exploit under the target environment’s security protections.

The researchers subsequently used Claude Opus 5.

The newer model helped develop a working exploit and adapt it to the relevant system architecture.

By July 25, the researchers had demonstrated remote code execution through the image-upload pipeline.

Claude accelerated the technical work, but human researchers still directed the investigation, evaluated results, and determined the next steps.

This was an AI-assisted security investigation, not an example of Claude independently deciding to attack OpenAI.

3. Exploiting an OpenAI SSO Misconfiguration

The image-processing vulnerability was only the initial entry point.

After gaining access to the forum environment, the researchers discovered a separate weakness in OpenAI’s single sign-on infrastructure.

Single sign-on allows users to authenticate across multiple services through a shared identity system.

In this case, the configuration weakness created a path from the compromised forum environment to connected ChatGPT and Codex accounts.

The researchers demonstrated that employee accounts could be affected.

This illustrates an important cybersecurity principle: the impact of a vulnerability depends not only on the compromised application but also on the permissions and integrations connected to it.

4. Demonstrating Access to OpenAI’s Internal GitHub Repository

After gaining access to an employee account, the researchers investigated what its connected services could reach.

The affected employee’s Codex account was connected to OpenAI’s GitHub organization.

To demonstrate the practical impact, the researchers used the account to open a harmless proof-of-concept pull request in OpenAI’s internal monorepo.

They then reported their findings and stopped testing.

The published investigation does not establish that proprietary model weights were stolen or that OpenAI’s production AI models were taken over.

Nevertheless, the demonstration showed how a vulnerability in a public-facing forum could create a path to sensitive internal development resources.

OpenAI Security Incident: Complete Timeline

The investigation took place in July 2026, while the findings attracted widespread international media attention in September.

Here is the timeline based on Hacktron AI’s disclosure report.

• July 23, 2026: Researchers began reviewing the Discourse image-upload pipeline.
• July 24, 2026: The team continued investigating the libheif vulnerability with assistance from Claude.
• July 25, 2026: Researchers confirmed remote code execution and demonstrated the wider account-access implications.
• July 25, 2026: OpenAI received the security report and confirmed that its side of the issue had been fixed approximately 14 hours after submission.
• July 27, 2026: Discourse had a fix ready and added further image-processing isolation.
• July 28, 2026: Discourse published its official security advisory.
• September 1, 2026: OpenAI awarded the researchers $6,500 and marked the report resolved.
• September 18, 2026: The investigation received widespread international news coverage.

You can read the complete disclosure timeline in the official Hacktron AI report.

What Is CVE-2026-32882?

CVE-2026-32882 is a vulnerability affecting the libheif image-processing library.

The flaw was associated with remote code execution through malformed HEIF image uploads in affected Discourse installations.

Discourse published security advisory GHSA-vhm9-85gw-x335, assigning the issue a CVSS v3.1 score of 8.8, classified as High severity.

The advisory identifies the following patched versions:

• Discourse 2026.7.0
• Discourse 2026.6.1
• Discourse 2026.5.2
• Discourse 2026.1.6

Administrators should follow the vendor’s guidance and ensure their deployed Docker images contain a patched version of libheif.

For technical details and remediation instructions, consult the official Discourse security advisory.

Did Claude Actually Hack OpenAI on Its Own?

No. The incident was a human-directed, AI-assisted cybersecurity investigation.

The Hacktron researchers selected the target, investigated the technical environment, used AI models to accelerate vulnerability analysis, and coordinated their findings with the affected companies.

Claude contributed to exploit development, including work that had previously been difficult for an earlier model version.

However, the published report does not establish that Claude independently selected OpenAI as a target or conducted the entire operation without human involvement.

This distinction matters because AI-assisted hacking and autonomous AI attacks represent different levels of human involvement.

AI tools can make security research faster, but their effectiveness still depends on the target environment, the available information, and how they are used.

For a broader discussion of increasingly capable artificial intelligence, read my article on GPT-6 Astra, AI capabilities, and the future of artificial intelligence.

Why Did OpenAI Pay a $6,500 Bug Bounty?

OpenAI awarded Hacktron AI $6,500 for the reported security findings.

Bug bounty programs allow security researchers to report qualifying vulnerabilities and potentially receive financial rewards.

However, there was an important distinction concerning the scope of this investigation.

According to OpenAI’s response reproduced in Hacktron’s report, testing against the Discourse-hosted community forum was explicitly excluded from OpenAI’s bug bounty program.

The award recognized the OpenAI-side identity vulnerability rather than the actions against Discourse itself.

The researchers separately reported the Discourse vulnerability through its security-reporting channel.

The case demonstrates why coordinated vulnerability disclosure is important.

Researchers, software vendors, and affected organizations need clear communication to investigate and remediate security weaknesses.

Why This Incident Matters for AI Cybersecurity

The Claude-assisted OpenAI investigation highlights how artificial intelligence is changing the speed and accessibility of cybersecurity research.

Developing a reliable exploit for a complex memory-corruption vulnerability traditionally requires specialized knowledge and substantial engineering effort.

Advanced AI tools can assist researchers with code analysis, vulnerability investigation, debugging, and technical problem-solving.

However, similar capabilities can create additional security concerns when used by malicious actors.

AI Can Accelerate Vulnerability Discovery

AI models can help researchers analyze large codebases and investigate software dependencies more efficiently.

Security teams can use these capabilities to prioritize findings, identify suspicious behavior, and reduce repetitive investigation tasks.

However, AI-generated findings still require validation because models can make mistakes or identify issues that are not exploitable in practice.

Connected AI Tools Can Expand the Attack Surface

AI assistants increasingly connect to GitHub repositories, cloud platforms, communication tools, and business applications.

These integrations improve productivity, but they also introduce additional security considerations.

If an account is compromised, connected applications may expose information or functionality beyond the original service.

Organizations should carefully review access permissions and apply the principle of least privilege to AI agents and integrations.

Third-Party Dependencies Require Continuous Monitoring

The initial weakness in this investigation involved an image-processing dependency.

This demonstrates why software security cannot focus exclusively on an application’s main codebase.

Open-source libraries, containers, authentication providers, and external services must also be monitored and updated.

What CMS Website Owners Can Learn From the OpenAI Incident

Although this investigation involved Discourse rather than CMS, its underlying security lessons apply to many modern websites.

A CMS website may depend on numerous components, including themes, plugins, PHP libraries, hosting services, third-party APIs, and authentication systems.

A vulnerability in one component can sometimes affect other connected systems.

Website owners should therefore treat security as an ongoing process rather than a one-time configuration.

1. Keep CMS and Plugins Updated

Use supported versions of CMS, themes, plugins, and server-side software.

Monitor security advisories and apply relevant patches promptly.

Avoid relying on outdated plugins or software that no longer receives security updates.

2. Review Third-Party Integrations

Audit the services connected to your website, including payment gateways, CRM platforms, automation tools, and authentication providers.

Grant only the permissions necessary for each integration to function.

Remove unnecessary integrations and revoke unused access tokens.

3. Strengthen Login Security

Enable multi-factor authentication where available, use strong passwords, and review administrative accounts regularly.

Remove unused accounts and avoid sharing administrator credentials.

4. Protect File Uploads

Restrict unnecessary file types, validate uploaded content, and maintain the software responsible for processing images and documents.

Where appropriate, isolate file-processing services from sensitive application resources.

5. Maintain Reliable Backups and Monitoring

Keep recoverable backups and monitor unexpected changes to files, user accounts, and website functionality.

These practices cannot eliminate every security risk, but they can reduce the likelihood and impact of a successful compromise.

If you are planning a new business website, explore my CMS website development services to learn more about building responsive, maintainable websites with a strong technical foundation.

You can also read my guide on how to choose a CMS developer for practical advice on website security, performance, ownership, backups, and ongoing maintenance.

Is OpenAI Safe After the Security Incident?

OpenAI confirmed that the reported issues were resolved, while Discourse also implemented fixes for the image-processing vulnerability.

That is an important outcome, but no single patch can guarantee that a complex software environment is free from every possible security weakness.

For ordinary ChatGPT users, the published investigation does not establish that all ChatGPT accounts were compromised.

The reported account-takeover path involved the affected forum and its connected authentication infrastructure.

Users should continue to follow standard account-security practices, including protecting their credentials, monitoring account activity, and reviewing connected services.

Organizations using AI tools should additionally evaluate access permissions and the security of their integrations.

Frequently Asked Questions

1. Did Anthropic’s Claude hack OpenAI?

Security researchers used Anthropic’s Claude to help identify and exploit vulnerabilities in OpenAI’s infrastructure. The investigation involved human-directed ethical hacking rather than an entirely autonomous AI attack.

2. Who hacked OpenAI using Claude?

The investigation was conducted by Harsh Jaiswal, Mohan Pedhapati, and Rahul Maini from Hacktron AI.

3. When did the OpenAI security incident happen?

The researchers demonstrated the vulnerability chain on July 25, 2026. The investigation became widely reported in September 2026.

4. How much did OpenAI pay the researchers?

OpenAI awarded the researchers a $6,500 bug bounty for the OpenAI-side security finding.

5. Was OpenAI’s source code stolen?

The published investigation does not establish that sensitive source code was stolen. The researchers demonstrated repository access through a harmless pull request and stated that they stopped testing without reading internal source code.

6. What vulnerability was used in the attack?

The initial vulnerability affected the libheif image-processing library. The researchers subsequently exploited an OpenAI SSO misconfiguration to access connected employee accounts.

7. Has OpenAI fixed the vulnerability?

Yes. OpenAI confirmed that its reported issue had been resolved. Discourse also released fixes and additional image-processing protections.

8. Does this mean AI can hack any website?

No. AI can assist with security research and exploit development, but a successful attack still depends on actual vulnerabilities, system configuration, available access, and other technical conditions.

9. What can website owners learn from this incident?

Website owners should maintain software updates, monitor third-party dependencies, strengthen authentication, review connected applications, secure file uploads, and implement appropriate security monitoring.

Final Thoughts: AI Is Changing the Future of Cybersecurity

The Claude-assisted OpenAI security incident demonstrates how a small research team can use advanced AI tools to investigate complex software vulnerabilities.

What began as an image-processing weakness in a public forum eventually exposed an identity configuration problem and a path to internal development resources.

The researchers reported their findings, OpenAI and Discourse addressed the vulnerabilities, and the team received a $6,500 bug bounty.

The broader lesson is that organizations must evaluate security across their entire technology stack.

AI can strengthen vulnerability research and defensive security, but its growing capabilities also make timely patching, access control, dependency management, and responsible AI integration increasingly important.

For businesses and website owners, maintaining a secure digital presence requires continuous attention rather than a one-time setup.

Need a Professional CMS Website?

I’m Jewel Khan, a CMS Developer focused on building fast, responsive, and maintainable websites for businesses and professionals.

Whether you need a new website, an existing website redesign, or improvements to your website’s technical foundation, I can help you develop a solution aligned with your business goals.

Explore my CMS development portfolio and services or contact me to discuss your website project.

Website: jewelkhan.me

WhatsApp: 01720514433