The July operation was carried out by three researchers at cybersecurity start-up Hacktron AI, who said they combined a vulnerability in software used by OpenAI’s community forum with a flaw in the company’s single sign-on configuration. OpenAI later fixed the weakness and paid the team a $6,500 bounty.
The researchers said they obtained remote-code execution and administrative access on community. openai. com, which runs on the Discourse forum platform, before moving from the compromised forum environment into ChatGPT and Codex accounts belonging to OpenAI employees. One account was connected to GitHub, enabling access to OpenAI’s internal repository system.
Rather than inspect or download proprietary code, the team said it used an employee’s Codex account to create a harmless proof-of-concept pull request inside OpenAI’s private openai/openai monorepo. The step was intended to demonstrate the level of access without exposing sensitive information. Testing then stopped and the findings were reported through OpenAI’s Bugcrowd programme.
The attack path began with a memory-safety flaw in libheif, an image-decoding library used in the processing of HEIF and HEIC image files. The researchers found that the vulnerable component could be reached through image uploads on the Discourse-based forum. A specially crafted image allowed them to trigger code execution on the forum system.
A second weakness involved OpenAI’s authentication setup. After gaining control of the forum environment, the researchers found that the single sign-on arrangement could be abused to impersonate users who had authenticated through the forum. That opened a route to employee ChatGPT and Codex accounts and, through connected services, potentially to other internal resources.
Hacktron said the work from initial investigation to repository access took less than 72 hours. The team began with a cybersecurity-enabled version of Claude Opus 4.8, but that model was unable to produce a working exploit for the image-processing vulnerability. After Anthropic released Claude Opus 5, the researchers switched models and said the newer system generated a functioning exploit within hours.
Anthropic says Opus 5 is designed with safeguards that restrict certain offensive cybersecurity tasks, while approved researchers can obtain less restrictive access through its Cyber Verification Program. The company has said the model can identify software vulnerabilities effectively, although it remains less capable at turning them into usable exploits than its specialist cybersecurity model, Mythos 5.
The OpenAI case nevertheless illustrates how frontier coding systems can reduce the time and expertise required for parts of vulnerability research. Hacktron said its broader testing campaign, covering several technology companies, cost less than $3,000 in model tokens. The researchers emphasised that human judgement remained necessary to identify targets, link separate weaknesses and decide how far testing should proceed.
OpenAI confirmed to the researchers on July 25 that its side of the vulnerability had been fixed, roughly 14 hours after the initial Bugcrowd submission. Discourse was separately notified through HackerOne and prepared a fix by July 27, adding further sandboxing around image processing. A security advisory for the libheif issue was published the following day.
OpenAI’s bounty payment covered the flaw affecting its own authentication system. The company clarified that testing directed at the Discourse-hosted community forum itself fell outside the formal scope of its bug bounty programme.
The episode did not amount to an uncontrolled theft of OpenAI source code, based on the researchers’ account. Their proof established that the compromised identity could cause Codex to interact with the private repository, while they deliberately avoided reading its contents. That distinction is important because the access demonstrated a serious potential exposure without evidence that proprietary code was copied. The underlying Discourse vulnerability was assigned CVE-2026-32882 and rated 8.8 on the standard CVSS severity scale by security maintainers.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
