How Hacktron Used Claude Opus 5 to Break Into OpenAI’s Internal Repositories

A three-person team at Hacktron AI says it used Anthropic’s Claude models to chain together a forum bug, a login flaw, and account takeover paths that reached OpenAI’s internal code. The work was done under OpenAI’s bug bounty program, the issues were fixed, and OpenAI paid the researchers $6,500. Hacktron says less than 72 hours passed between the first discovery and access to OpenAI’s internal monorepo.

The first weak point was OpenAI’s community forum, which runs on Discourse and uses OpenAI logins. Hacktron went after the image-processing path instead of Discourse itself. On uploads in HEIC or HEIF format, Discourse sends files through ImageMagick and then libheif, where the team found a heap buffer overflow. The catch is ugly: the buggy code had already been changed the year before, but the change wasn’t labeled as a security fix and never got a CVE. Hacktron says that left Debian 12 and 13 packages without the patch, and Discourse’s Debian 12-based Docker image shipped the vulnerable version.

Claude Opus 4.8 helped first, but only got the exploit working with ASLR turned off. Opus 5 was the one that made the jump. Hacktron says it produced a working local Mac exploit in three hours, then adapted it to Discourse’s x86-64 setup. The researchers then put the model into an autonomous loop against their own Discourse Cloud instance, disguising the target as a capture-the-flag exercise because Opus refused to write remote exploits. Within a few hours, the agent got code execution on the test system, and the final exploit script was used against OpenAI’s forum server.

That would have been bad enough on its own. A second flaw in OpenAI’s single sign-on let the team take over ChatGPT and Codex accounts from the compromised forum with no victim action required. Hacktron says the weakness was in OpenAI’s identity layer, so any compromised service using the same login could have opened the door. The team took over an employee account linked to GitHub and had Codex file a harmless pull request in the internal monorepo to show the impact without viewing code. They stopped there. OpenAI confirmed a fix about 14 hours after the report, and Discourse shipped a patch within days and added sandboxing for image processing.

Hacktron says this was part of a broader project called HEIF Heist, where it spent two months tracking the libheif issue across Slack, Meta, GitHub Enterprise and frameworks like Next.js. The whole campaign cost less than $3,000 in tokens. It’s a neat little warning shot: complexity used to buy companies some safety by making attacks expensive. That cushion looks thinner every month.