Researchers reached internal repositories through two separate flaws
Hacktron says its researchers compromised OpenAI's community forum on 25 July and then chained that access into an OpenAI identity flaw that could take over active forum members' ChatGPT and Codex accounts without further interaction. When one affected account belonged to an OpenAI employee whose Codex environment was connected to GitHub, the researchers asked Codex to open a harmless pull request in OpenAI's internal monorepo. They say they used that action only to prove repository access and stopped testing without inspecting or copying private source code.
Hacktron submitted the OpenAI-side issue through Bugcrowd on 25 July. Its timeline says OpenAI confirmed the fix at 22:49 UTC, roughly 14 hours after the first report, and awarded a $6,500 bounty on 1 September. TechCrunch reports that OpenAI said the issues uncovered by Hacktron have been resolved. OpenAI has not published a detailed first-party postmortem of the SSO weakness or the internal-repository access path.
The first step was a libheif RCE behind image uploads
The entry point sat in the image-processing path used by Discourse. Hacktron says a crafted HEIF or HEIC upload could reach a vulnerable libheif build through ImageMagick and produce remote code execution on the forum host. The researchers first developed the exploit locally and then reproduced it against their own Discourse Cloud environment before testing the OpenAI forum within the responsible-disclosure programme.
Discourse's advisory independently confirms the underlying vulnerability as CVE-2026-32882, rated High with a CVSS score of 8.8, and says malformed HEIF uploads could trigger remote code execution through libheif. Discourse patched the issue in versions 2026.7.0, 2026.6.1, 2026.5.2 and 2026.1.6 and updated its Docker image with a patched libheif build. It also says supported releases add further image-processing sandboxing.
The second step crossed OpenAI's identity boundary
After gaining control of the forum, Hacktron says the researchers found an OpenAI SSO weakness that let the compromised service mint or reuse an identity path into ChatGPT and Codex for active OpenAI community members. The researchers describe the flaw as OpenAI-side rather than a property of Discourse itself, which means the forum compromise was the entry path rather than the complete account-takeover mechanism.
The proof reached a sensitive boundary, but the public evidence has limits. Hacktron demonstrates repository access with the benign pull request and TechCrunch reports OpenAI's acknowledgement that the reported issues were resolved. There is no public evidence that the researchers exfiltrated OpenAI source code, that the chain was exploited maliciously in the wild, or that unrelated OpenAI customer accounts were compromised through the same route.
Claude compressed exploit work, with researchers still directing it
Hacktron says Claude Opus 4.8 could produce a proof of concept only when address-space randomisation was disabled. After Anthropic released Opus 5 on 24 July, the team started a fresh session and says the model produced a working ARM64 exploit against the hardened configuration within about three hours, followed by an x86-64 and jemalloc adaptation. That is Hacktron's account of one exploit-development task, not an independent benchmark of model capability.
The broader HEIF research campaign involved three researchers, ran for more than two months and cost less than $3,000 in model tokens according to Hacktron. The team explicitly says skilled human guidance remained important and does not describe the work as fully autonomous. The security significance is therefore narrower and more concrete: frontier models can materially compress parts of exploit development when experienced researchers define targets, test failures and steer the investigation, while the reliability and autonomy of that process remain unproven beyond this disclosure.