Overview
- A security team at Hacktron used Anthropic’s Claude models to develop a working exploit that moved from an OpenAI Discourse forum to employee ChatGPT and Codex accounts and then to an internal GitHub repository, with discovery to proof of access taking under 72 hours and disclosed in September 2026.
- The chain began with a remote‑code execution flaw in the libheif library that processes HEIC/HEIF images on the Discourse forum and was amplified by a misconfigured single‑sign‑on setup that allowed lateral access to linked accounts.
- Hacktron said initial attempts used Claude Opus 4.8 and succeeded after Opus 5 became available, and reporters noted the team had access to a private Claude build for qualified security researchers.
- OpenAI told reporters it patched the reported vulnerabilities, tightened forum access tokens and sessions, granted Hacktron a $6,500 bug‑bounty payment, and said no sensitive internal code was downloaded during the responsible disclosure.
- Security experts say the case shows how AI can lower the time and cost to turn bugs into exploits, widens risk from third‑party components, and strengthens arguments for stronger supply‑chain fixes, broader bug‑bounty scopes, and independent AI security oversight.