AI Agent Helped Hackers Reach OpenAI Accounts in 72 Hours

Three researchers at cybersecurity startup Hacktron used Anthropic’s Claude agent to combine an image-processing vulnerability in OpenAI’s Discourse forum with an identity flaw in OpenAI’s single-sign-on system and, within 72 hours, gained control of employee ChatGPT and Codex accounts and a route into an internal repository. The team stopped after creating a harmless pull request and disclosed the issues to the companies.

The researchers began testing OpenAI’s Discourse image-upload pipeline on July 23, focusing on HEIC/HEIF files processed by ImageMagick and the libheif decoder. They asked Claude Opus 4.8 to inspect a Discourse Docker image for weaknesses in the libheif package. The model identified missing security fixes that left a heap buffer overflow and produced an exploit that worked when address space layout randomization (ASLR) was disabled.

Anthropic released Opus 5 on July 24. In a new session, the model generated a working ARM64 exploit in about three hours. Hacktron then had Claude adapt the exploit to x86-64 and to Discourse’s jemalloc memory configuration. By 6 a.m. on July 25 the researchers had a working exploit that executed code via a malicious image upload.

After obtaining a local foothold, the team tested whether Claude could reproduce the attack against a remote environment with limited human intervention. When the model initially refused to craft an exploit directly for a remote system, Hacktron proxied the test environment to resemble a capture-the-flag challenge. Four hours later the agent reproduced the attack against the remote test instance. The same exploit was used against OpenAI’s public Discourse forum, where the researchers gained administrative access.

A separate flaw in OpenAI’s single-sign-on allowed the researchers to move from the forum into employee ChatGPT and Codex accounts. One compromised Codex account was linked to OpenAI’s GitHub organization, giving a path into the company’s private openai/openai monorepo. The researchers instructed the compromised Codex account to open a harmless pull request and did not inspect proprietary source code.

Hacktron disclosed the vulnerabilities this week and stopped further testing. OpenAI fixed the identity-side flaw about 14 hours after receiving the report and issued a $6,500 bounty to the researchers. Discourse prepared a patch by July 27 and added additional sandboxing around its image-processing pipeline. OpenAI also tightened access controls following disclosure.

Mohan ‘s1r1us’ Pedhapati, co-founder of Hacktron, observed: ‘Our main takeaway from hacking OpenAI: AI is reducing the amount of scarce expertise needed to develop exploits. Work that once took months can now take days.’ He also noted the operation required experienced human researchers and that skilled human guidance remained important.

Robert Reith, founder of Accretion, warned: ‘There’s still a large gap between what skilled researchers + AI can do vs. general population + AI. The scary part is that this gap may become smaller as AI absorbs this knowledge and intuition over time.’ Codey Blakeney, research lead at Arcee, added that coding agents integrated with services like GitHub, Slack and email can expand what a compromised account can reach. Maxime Fournes, CEO of PauseAI, pointed out that defenders must secure many potential flaws while attackers need to find a single oversight.

The researchers said the incident highlighted how a coding agent helped produce and adapt an exploit quickly while human operators guided testing and deployment.