Hacktron Says Claude-Assisted Chain Reached OpenAI’s Internal GitHub Environment

Hacktron AI security researchers say they used Anthropic’s Claude Opus 5 to help build an exploit chain that reached an OpenAI employee’s ChatGPT and Codex environment. Using the account’s GitHub connection, they created a benign pull request in an internal repository; Hacktron says OpenAI fixed its part of the issue after disclosure.

The reported incident began with OpenAI’s Discourse-hosted community forum. Hacktron said HEIC and HEIF image uploads reached a heap buffer overflow in the libheif image-processing library, creating a route to remote code execution. Discourse independently confirmed the upstream image-upload vulnerability, gave it a CVSS severity score of 8.8, patched affected releases and added extra image-processing sandboxing.

The forum was a foothold, not the final destination

Hacktron said a separate flaw in OpenAI’s single sign-on implementation turned control of the forum environment into access to ChatGPT and Codex accounts authenticated through that service, including employee accounts. The researchers say an AI account could be connected to services such as GitHub, Slack, email and cloud storage, making its permissions more consequential than those of a standalone chatbot.

A proof of access with important limits

For its proof of concept, Hacktron said an OpenAI employee’s Codex environment was connected to OpenAI’s GitHub organization. The team said it did not examine sensitive source code; instead, it instructed Codex to prepare a harmless change in the internal openai/openai monorepo. The demonstration did not establish that the researchers could merge code, deploy software, access customer data or cause operational damage.

The reported remediation

• Hacktron said it reported the findings through OpenAI’s Bugcrowd program on July 25.
• Hacktron said OpenAI confirmed later that day that it had fixed its side of the vulnerability.
• Libheif’s September 6 release included additional high-severity security fixes.

Claude’s role was reportedly exploit development

Hacktron said Claude Opus 4.8 struggled to make the memory-corruption exploit reliable with address-space layout randomization enabled. After switching to Opus 5, the researchers said the model produced a working ARM64 exploit within hours and helped adapt it to Discourse’s x86-64 and jemalloc setup. That is Hacktron’s account of model performance, rather than an independently verified benchmark.