TL;DR: Security research team Hacktron AI used Claude to chain together a vulnerability in HEIF image files on OpenAI’s Discourse forum, hijacking multiple employees’ ChatGPT accounts and ultimately reaching an internal OpenAI repository. The whole operation ran under an OpenAI-authorized bug bounty program, not an illegal attack.
Hacktron AI, a three-person cybersecurity startup founded by Mohan Pedhapati, used Claude as an assistant to hunt down and chain a vulnerability that let the team take over multiple OpenAI employees’ ChatGPT accounts and go on to access an internal company repository. The entire operation took place under OpenAI’s bug bounty program on Bugcrowd — a pre-authorized security test, not an unlawful breach.
The case stands out because it shows Claude doing more than helping write code: it directly determined the outcome of a real hacking exercise. An older model couldn’t finish the job, but a newer model released mid-engagement closed it out within hours.
The Vulnerability Started With an Ordinary HEIF Image File
OpenAI runs Discourse as an internal forum for employees. When someone uploads a HEIF/HEIC image, the file passes through ImageMagick, which calls the libheif library to decode and convert it to another format. Hacktron AI found that libheif had a memory bug caused by a miscalculated image position — one that a specially crafted image file could exploit to compromise the server.
From there, the team chained their way into taking over multiple employees’ ChatGPT and Codex accounts. Because those Codex accounts were tied directly to OpenAI’s GitHub organization, the team was able to open an innocuous-looking pull request to prove they could reach an internal repository. The whole process, from discovering the initial entry point on July 25 to reaching the internal repo, took under 72 hours. Discourse shipped a fix for the underlying issue on July 27.
The Turning Point: Opus 4.8 Failed, Opus 5 Closed It Out in Hours
At first, the team gave the task of building a working exploit for the libheif bug to Claude Opus 4.8, which couldn’t produce one that worked. When Anthropic released Claude Opus 5, the team fed it the same problem again — and this time it built a working exploit within hours of the new model’s release.
| Factor | Claude Opus 4.8 | Claude Opus 5 |
|---|---|---|
| Result building an exploit for the libheif bug | Failed to produce a working exploit | Succeeded in producing a working exploit |
| Time to a working exploit | Never succeeded despite repeated attempts | Within hours of the new model's release |
That gap says more than any marketing claim could, since it’s the same exact problem tested against two model versions. The difference reflects a genuine jump in exploit-development capability between releases, not just a benchmark score.
From Employee Accounts to a Door Into the Company’s GitHub
What made this case draw extra attention was the second stage. After hijacking ChatGPT accounts, the team didn’t stop there — they pushed on to Codex accounts tied to OpenAI’s corporate GitHub, then opened a real pull request to prove that reaching an internal repository wasn’t just theoretical. That’s what led OpenAI to treat the vulnerability as high-impact and pay Hacktron AI a $6,500 reward through its Bugcrowd bug bounty program.
A Lesson for Security Teams as AI Speeds Up Hacking
This case is a warning on two fronts. First, a small flaw in an image-processing library like libheif — used quietly by countless systems — can become the starting point for a full enterprise breach. Second, as newer AI models make it much faster to turn a known vulnerability into a working exploit, defensive teams need to close the patch window just as fast, the way Discourse managed to do within two days of the issue being found.
I’d call this a good example of using AI for security work within clear boundaries. Every step happened inside an authorized bug bounty program, not a covert attack, and the findings went straight back to OpenAI for a fix rather than being exploited for harm. It’s a model other organizations should probably start borrowing for testing their own systems.