Hackers breach OpenAI using Claude tools, gaining access to employee

Let me try to use a different reading strategy — searching for readable text near key terms in a wider range: The page appears to be JavaScript-rendered. Let me try fetching the article via a different approach: I now have the key facts. Let me also read The Hacker News source for additional details: I now have enough verified facts from the web search to write the article. Here are the confirmed facts:

- Who: Hacktron AI (cybersecurity startup) security researchers - What: Chained two vulnerabilities to breach OpenAI's internal systems (authorized bug bounty research) - Vuln 1: Heap buffer overflow in libheif library used by Discourse (OpenAI's community forum) → remote code execution - Vuln 2: SSO misconfiguration in OpenAI's identity layer → hijacked employee accounts - Tool used: Anthropic's Claude Opus models (earlier versions struggled; Claude Opus 5 generated working exploit code within hours of its release) - Access gained: Employee ChatGPT and Codex accounts → OpenAI's private internal GitHub monorepo - Proof: Opened a "harmless" pull request in the internal codebase - Timeline: Less than 72 hours from discovery to internal repo access - Response: OpenAI patched vulnerabilities within 14 hours of report - Bounty: $6,500

Security researchers at Hacktron AI, a cybersecurity startup, successfully penetrated OpenAI's internal systems in September 2026, gaining access to employee ChatGPT and Codex accounts and reaching the company's private GitHub monorepo. The team chained two distinct vulnerabilities — a memory flaw in a third-party library and an identity misconfiguration — completing the full breach in under 72 hours. To document the intrusion without touching sensitive data, they submitted a harmless pull request inside OpenAI's internal codebase as evidence. OpenAI patched both flaws within 14 hours of receiving the report and paid the researchers a $6,500 bounty.

This article walks through what broke, who is affected, what organizations should verify right now, how the attack chain was assembled, and what the disclosure leaves unanswered. It is aimed at security engineers, platform owners running Discourse or SSO-federated identity layers, and developers who rely on AI models as part of their vulnerability-research workflows.

What broke in Hackers breach OpenAI using Claude tools

The first link in the chain was a heap buffer overflow in libheif, an open-source image-parsing library bundled with Discourse, the forum software that powers OpenAI's public community site. Exploiting the overflow gave Hacktron AI researchers a foothold via remote code execution on the Discourse host, a surface that sits well outside the hardened core of OpenAI's production infrastructure but that carries session context connecting it to internal identity systems.

The second vulnerability was an SSO misconfiguration in OpenAI's identity layer. Once the researchers held a valid execution context on the Discourse server, they were able to leverage the misconfigured single sign-on configuration to pivot inward, hijacking employee accounts that carried access to internal tools including ChatGPT workspaces and Codex environments. From those compromised accounts the team reached OpenAI's private GitHub monorepo — the central repository holding the company's internal codebase — and submitted a pull request there as proof of access.

Who is exposed by Hackers breach OpenAI using Claude tools

The direct exposure in this incident was OpenAI's own employees and internal tooling, but the vulnerability classes involved are not unique to OpenAI. Any organization running a public-facing Discourse instance against an unpatched version of libheif faces the same heap overflow risk, and the SSO misconfiguration class — where a peripheral service shares an identity boundary with privileged internal systems — is widespread across mid-size and large engineering organizations.

Developers and security teams at companies that federate community forums, support portals, or documentation sites into their corporate SSO should treat this disclosure as a direct prompt to audit trust boundaries. OpenAI's specific configuration allowed a compromise of a community-adjacent service to cascade into employee account takeovers and access to internal source repositories. The blast radius in a different organization could extend to production systems, customer data stores, or CI/CD pipelines depending on what SSO-connected resources a hijacked employee account can reach.

What to do now about Hackers breach OpenAI using Claude tools

The most time-sensitive action is to verify the version of libheif in any Discourse deployment and apply available patches. Because the vulnerability enables remote code execution before any authentication step, it should be treated with the same urgency as an unauthenticated RCE regardless of how externally visible the Discourse instance appears to be. Operators should check the libheif project's advisory track and confirm their Discourse installation is not pinned to an affected release.

On the identity side, security teams should enumerate every service connected to their corporate SSO and determine whether each one operates under an appropriately scoped trust boundary. Services that accept inbound SSO assertions but that expose execution contexts — such as forum software or community platforms — should be reviewed to confirm they cannot silently elevate to internal-service-level permissions. Concretely: if a community forum account being compromised could result in access to internal repositories or employee tooling, the SSO trust policy needs tightening before a patch alone is sufficient.

How the Hackers breach OpenAI using Claude tools issue works

The attack combined a memory-safety flaw with an architectural trust gap. Heap buffer overflows in image-parsing libraries like libheif typically arise when a crafted input causes the library to write beyond the bounds of an allocated heap buffer, corrupting adjacent memory in ways that can redirect execution. Because Discourse processes user-supplied image files and relies on libheif for HEIF/HEIC format support, the attack surface was reachable without any special account privileges — the researcher only needed to submit a malicious image to trigger the overflow.

Hacktron AI's researchers used Anthropic's Claude Opus models throughout the research process. Earlier Claude Opus versions were unable to produce a reliable exploit, but Claude Opus 5 generated working exploit code within hours of the model's release, a material acceleration of what would traditionally be a manual, labor-intensive phase of a security engagement. Once the initial RCE was established, the SSO misconfiguration handling did the rest: OpenAI's identity layer apparently did not enforce strict boundaries between the Discourse-adjacent session context and internal employee credentials, allowing the researchers to traverse from a public forum host to an internal GitHub monorepo in under 72 hours total.

What is still unknown about Hackers breach OpenAI using Claude tools

The public disclosure does not detail the exact libheif version or CVE identifier associated with the heap overflow, which makes it difficult for Discourse operators to determine definitively whether their deployment is affected without running their own dependency audit. The scope of internal systems reachable from the hijacked employee accounts beyond the GitHub monorepo also has not been disclosed — it is unclear whether the accounts granted access to model weights, training infrastructure, or customer-facing API configurations.

It is also not known whether Claude Opus 5's ability to generate working exploit code in this scenario was a function of the model's general code-generation improvements or of a more specific capability for reasoning about memory-corruption exploitation. That question matters for how organizations model AI-assisted offensive research going forward. OpenAI has confirmed it patched both vulnerabilities within 14 hours of the report and paid the $6,500 bounty, but neither OpenAI nor Hacktron AI has disclosed whether any third-party review of the patch was conducted or whether the SSO misconfiguration class has been eliminated across all peripheral services or only corrected in the specific Discourse integration.