Quick Facts
- Hacktron AI’s three-person team used Claude Opus 5 to build a working exploit in about three hours, then pivoted through an OpenAI SSO flaw to reach internal GitHub, Slack, and Outlook accounts.
- The entire operation from initial discovery to opening a pull request in OpenAI’s private monorepo took less than 72 hours and cost under $3,000 in AI token usage.
- OpenAI patched its SSO flaw within 14 hours of the report; Discourse published its patch on July 28 as GHSA-vhm9-85gw-x335.
Three security researchers at startup Hacktron AI breached OpenAI’s internal code repository on July 25, 2026, using Anthropic’s Claude Opus 5 as a core part of the attack chain. The team disclosed the operation after reporting it to OpenAI and Discourse in July.
Researchers Harsh Jaiswal, Mohan Pedhapati, and Rahul Maini exploited a heap-buffer overflow in libheif 1.19.7, a library used by Discourse’s image-processing stack on OpenAI’s community forum. The bug had been silently fixed upstream with no CVE assigned, leaving older Debian-based Discourse installations exposed.
How Claude Opus 5 Changed the Equation
The team first tasked Claude Opus 4.8 with building an exploit. It achieved code execution only when address space layout randomization was disabled, failing repeatedly under Discourse’s default configuration. After Anthropic released Claude Opus 5 on July 24, the researchers gave it the same task.
Opus 5 produced a working ARM64 exploit for a local Mac within three hours, then ported it to Discourse’s x86-64 and jemalloc environment. By 6:00 UTC on July 25, the team had confirmed remote code execution through an image upload to OpenAI’s forum.
The SSO Pivot
The image vulnerability alone was not the story. OpenAI’s single sign-on implementation accepted logins from external services without additional verification checks. That flaw let the researchers take over forum accounts belonging to OpenAI employees once they had code execution on the Discourse server.
One compromised account used GitHub SSO, which gave the team a path into OpenAI’s internal monorepo. The researchers stopped short of reading sensitive source code. Instead, they opened pull request number 1186742 in the private openai/openai repository as proof of access.
Hacktron founder s1r1us stated: “We proved it with a PR in OpenAI’s internal codebase. It took us less than 72 hours.”
Scope and Cost
The breach was part of a broader research project Hacktron called HEIF Heist, which targeted image-processing vulnerabilities across Slack, Zoom, Meta, and other companies. The two-month project cost less than $3,000 in total AI token spend. Adapting the exploit to each new target typically took one or two days.
OpenAI paid Hacktron a $6,500 bug bounty and patched its SSO flaw within 14 hours of the report. Discourse published its patch three days later.
What This Means for Security Teams
The operation shows that AI coding agents are compressing the time and cost required to build sophisticated exploit chains. A task that once demanded deep assembly expertise and days of manual work now takes a small team a few hours and a few hundred dollars in API calls.
Hacktron warned that the SSO issue was not specific to Discourse. Any first-party or third-party OpenAI service using the same SSO system would have been an equivalent entry point. The team wrote: “Capabilities that once required significantly more time, expertise and resources are becoming accessible to much smaller teams. The only solution is to keep AI safety and cybersecurity in the same conversation.”
For software and SaaS operators, the case makes three things clear: peripheral services expand your attack surface in ways that SSO can amplify, unassigned upstream patches leave known bugs invisible to standard CVE tracking, and AI tools available to defenders are equally available to attackers.
Read more: OpenAI hacked by small team of white hat security researchers using Anthropic’s Claude Opus 5