On July 25, 2026, three security researchers at Hacktron AI took over the ChatGPT and Codex accounts of OpenAI employees and, through one of those accounts, opened a pull request in OpenAI’s internal monorepo. It took them less than 72 hours from first look to that pull request, and Claude wrote most of the exploit. Hacktron published the full account, Hacking OpenAI, on September 13; the Wall Street Journal turned it into a headline early on September 18, and by the afternoon every outlet had a version.
Most of those versions are wrong in the same three places, so this page does what our Claude incidents record and our OpenAI misalignment record do: the primary read in full, every claim dated, the coverage graded against the source. The chain is genuinely interesting engineering. The lesson for anyone running AI agents at a small company is simpler than the chain, and it lives in the last link.
On this page · 11 sectionsOpen
On July 25, 2026 three researchers at Hacktron AI (Harsh Jaiswal, Mohan Pedhapati, Rahul Maini) chained two vulnerabilities into ChatGPT and Codex accounts belonging to OpenAI employees, then had one employee’s Codex open a harmless pull request in OpenAI’s internal monorepo. From first look to that PR took under 72 hours. Hacktron published the write-up on September 13; the Wall Street Journal ran the story on September 18.
The first bug was not OpenAI’s code: a heap overflow in libheif, an image library, reached through ImageMagick inside Discourse, the forum software behind community.openai.com. The second bug was OpenAI’s: a misconfiguration in Sign in with OpenAI that turned forum access into account takeover. Hacktron’s own emphasis is that the escalation is the OpenAI sign-in issue, and Discourse was merely one way of proving it.
Nobody read OpenAI’s code. Hacktron says it proved access without allowing itself to learn any sensitive information: one pull request through the employee’s Codex, then all testing stopped at about 15:30 UTC on July 25. Slack, email and other connectors were reachable from the accounts; the write-up does not claim any were touched.
Claude wrote the exploit, humans steered. Opus 4.8 found the unpatched libheif fixes and produced an exploit that worked only with memory protections off; Claude Opus 5, released that evening, produced a working exploit within about three hours. Hacktron also used GPT-5.6 Sol across the wider campaign and says skilled human guidance remained important.
OpenAI fixed its side about 14 hours after the report and paid a $6,500 bounty on September 1, while noting that testing against the Discourse-hosted forum was explicitly excluded from its bug bounty program. Discourse had a fix in two days and an advisory in three; Debian shipped the libheif update on August 8.
The headlines added things the primary does not say: that the researchers reached OpenAI’s algorithmic secrets, that Slack or email was read, that the hack was authorized end to end, or that Claude did it alone. Each is graded against Hacktron’s text below.
The lesson is the last link, not the first. Six links of plumbing paid off through one thing: an employee’s coding agent connected to the company’s GitHub. Any business wiring an AI agent to its tools should read this as a question about scope and approvals, not about image libraries.
§ 01What we actually know
| Claim | Status |
|---|---|
| OpenAI employee accounts were taken over | Hacktron, primary: ChatGPT and Codex accounts of multiple OpenAI employees, plus some unaffiliated forum users |
| The researchers reached OpenAI’s internal code repository | Hacktron: one pull request opened through an employee’s Codex connected to OpenAI’s GitHub; no code read |
| They accessed OpenAI’s algorithmic secrets | Coverage; not in the primary, which says the team avoided learning any sensitive information |
| They read Slack or email | Coverage; the primary lists these as connectors the accounts could reach, not as things touched |
| The whole exercise took under 72 hours | Hacktron: July 23 first look to July 25 internal PR |
| Claude did it | Partly: Opus 4.8 found the bug and wrote a first exploit, Opus 5 wrote the working one; humans directed; GPT-5.6 Sol used elsewhere in the campaign |
| It was an authorized hack | Responsible disclosure with a bounty; OpenAI says the Discourse-hosted forum was excluded from its bounty scope |
| OpenAI fixed it in 14 hours and paid $6,500 | Hacktron timeline: fix confirmed 22:49 UTC July 25; bounty and resolution September 1 |
| Discourse fixed its side | Report July 25, response July 26, fix July 27, advisory GHSA-vhm9-85gw-x335 July 28 |
| The bug is Discourse-specific | Hacktron: no. “It is an OpenAI SSO issue that turned the forum compromise into access to ChatGPT and Codex” |
§ 02The chain, dated
Hacktron’s write-up and its disclosure timeline give every step a date; the times below are its own, in UTC.
| Date (2026) | Step | Detail |
|---|---|---|
| Jul 23 | Discourse image pipeline reviewed | HEIC and HEIF uploads bypassed FastImage and went to ImageMagick, which uses libheif |
| Jul 24 | Bug found with Claude Opus 4.8 | Security fixes never backported to Debian’s libheif 1.19.7: a heap buffer overflow during HEIC decoding |
| Jul 24 | First exploit, protections off | Works with ASLR disabled; several sessions fail to make it reliable against Discourse’s default configuration |
| Jul 24, evening | Claude Opus 5 released | A new session produces a working ARM64 exploit within about three hours, then ports it to x86-64 and jemalloc |
| Jul 25, 06:00 | Local code execution confirmed | Through an image upload on a local Discourse |
| Jul 25, 10:00 | Code execution on Discourse Cloud | An autonomous Claude loop against Hacktron’s own test forum, then the same script against OpenAI’s forum |
| Jul 25, 08:00 to 10:00 | Report to OpenAI | Submitted through Bugcrowd after confirming the cross-product impact |
| Jul 25, 13:30 to 15:30 | Employee account, one PR, stop | An employee’s Codex, connected to OpenAI’s GitHub, opens PR #1186742 in openai/openai; testing stops at about 15:30 |
| Jul 25, 22:49 | OpenAI-side fix confirmed | About 14 hours after the report |
| Jul 27 | Discourse fix ready | Plus sandboxing of ImageMagick as defense in depth |
| Jul 28 | Discourse advisory | GHSA-vhm9-85gw-x335 |
| Aug 8 | Debian security update | The libheif package for Debian 13 |
| Sep 1 | OpenAI pays $6,500 | Marked resolved; OpenAI notes the Discourse-hosted forum was excluded from its bounty scope |
| Sep 13 | Hacktron publishes | Hacking OpenAI, 11-minute read, three authors |
| Sep 18 | The story breaks | Wall Street Journal first, shortly before 02:00 UTC; Hacktron’s own thread follows at 03:55 UTC |
§ 03Two bugs, in plain words
The first bug was in an image library. HEIC is the format iPhones shoot by default; libheif is the open-source code that decodes it. Discourse checked most uploads with a library called FastImage, but FastImage did not understand HEIF, so those files went to ImageMagick, which handed them to libheif. Debian’s libheif package was missing a set of upstream fixes that had never been labelled as security fixes and carried no CVE, so a crafted image could overflow the decoder’s memory and run code on the forum server. That gave the team administrative access to community.openai.com.
The second bug was OpenAI’s, and Hacktron is careful to say it is the one that matters. The forum let people sign in with their OpenAI account. A misconfiguration in that identity flow meant that whoever controlled the forum could take over the ChatGPT and Codex accounts of anyone who had logged in through it, including OpenAI employees. In Hacktron’s words, “It is an OpenAI SSO issue that turned the forum compromise into access to ChatGPT and Codex”; any other service using the same sign-in would have opened the same door.
§ 04What Claude did, and what it did not
The headline version is that Claude hacked OpenAI. The write-up describes something narrower. On July 24 the team gave Claude Opus 4.8 the Discourse Docker image and asked it to inspect the installed libheif for security issues; it found the missing backports and wrote an exploit that worked with memory protections off, then failed across several sessions to make it work with them on. That evening Anthropic released Claude Opus 5. A fresh session produced a working exploit within about three hours and ported it to Discourse’s environment. Hacktron: “we gave it the same problem and it succeeded”.
The team then ran Claude in an autonomous loop against its own test forum, disguised as a capture-the-flag target because the model refused to write exploits for remote instances, and used the resulting script against OpenAI’s forum. The account takeover, the choice of target, the report and the stopping point were human decisions, and the write-up says so: “skilled human guidance remained important”. Across the wider campaign the team also leaned on GPT-5.6 Sol when it had to exploit a target knowing nothing about its environment.
| Model | Role in the chain |
|---|---|
| Claude Opus 4.8 | Found the unpatched libheif fixes; wrote an exploit that only worked with ASLR disabled |
| Claude Opus 5 | Working exploit within about three hours of its release; port to x86-64 and jemalloc; autonomous loop reached code execution on a test forum |
| GPT-5.6 Sol | Used elsewhere in the two-month campaign when the target environment was unknown |
| The three humans | Target selection, the sign-in hypothesis, the report, the one PR, the stop |
The cost line is the part worth remembering: “The Discourse and OpenAI hack took a few days for an agent, and just a few hours of human time”, and the whole two-month campaign across several companies “cost less than $3,000 in tokens in total”.
§ 05Reachable is not touched
The write-up draws a line that most of the coverage erased. The compromised accounts could reach a lot: “the scope of what we could theoretically access was huge, including GitHub, Slack and emails”. What the team did with that reach was one thing. “To prove we had in fact gained the access we believed without allowing ourselves to learn any sensitive information”, it sent a prompt to one employee’s Codex, whose account was connected to OpenAI’s GitHub organization, and had it open a harmless pull request in the internal monorepo. Then it stopped, at about 15:30 UTC on July 25, and updated the report.
| Surface | Reachable | Touched |
|---|---|---|
| Employee ChatGPT accounts | Yes, taken over | Used to confirm the takeover |
| Employee Codex accounts | Yes, taken over | One prompt to one account |
| OpenAI internal GitHub (openai/openai) | Yes, via the connected Codex | One pull request, PR #1186742; no code read |
| Slack | Reachable via connectors | Not touched, per the write-up |
| Reachable via connectors | Not touched, per the write-up | |
| Unaffiliated forum users’ accounts | Also exposed | Not touched |
§ 06Headline vs primary
| Headline claim | Hacktron’s write-up | Grade |
|---|---|---|
| Researchers reached OpenAI’s algorithmic secrets | One PR opened; the team avoided learning any sensitive information | Not supported |
| Slack, email or Drive were accessed | Named as connectors the accounts could reach; nothing read | Not supported |
| An authorized hack | Responsible disclosure and a bounty; OpenAI says the forum was outside its bounty scope | Half right |
| Claude hacked OpenAI | Claude wrote the exploit under human direction; GPT-5.6 Sol also used | Half right |
| Under 72 hours | July 23 first look to July 25 internal PR | Supported |
| OpenAI fixed it in 14 hours | Report between 08:00 and 10:00 UTC, fix confirmed 22:49 UTC | Supported |
The two half-right claims are the interesting ones. The bounty is real, $6,500 paid on September 1, but OpenAI’s own comment in the timeline says “testing against the Discourse-hosted community.openai.com was explicitly excluded from our bug bounty program” and “The award recognizes the OpenAI-side finding, not the actions against Discourse”. That is not the language of a permitted penetration test. And Claude’s part is large without being the whole: the model found the bug and wrote the exploit, the humans chose where to point it and when to stop.
§ 07How fast each party fixed its part
| Party | Fix | Days after the report |
|---|---|---|
| OpenAI (sign-in flaw) | Confirmed fixed 22:49 UTC July 25 | 0.6 |
| Discourse (image pipeline) | Fix ready July 27, advisory July 28 | 2 |
| Debian (libheif package) | Security update August 8 | 14 |
| libheif upstream | v1.23.4 security release, current as of September 14 | 51 |
§ 08Where CellCog stands
Six links of plumbing paid off through one thing: an employee’s coding agent with GitHub attached. That is the whole of the lesson for a small business wiring AI agents into its tools, and it is not a lesson about image libraries. Whatever your agents can write to is your blast radius, and a stolen session inherits all of it. Hacktron’s team chose to open one harmless pull request; the next person holding that session might not.
We built CellCog AI employees around that boundary. Each employee holds only the tools its owner grants; the agent classifies every command before it executes, and the platform rejects any command that arrives unclassified; and every command that reaches your world, your machine, your real browser, your connected tools, passes an approval rail the owner sets, with a record of what the employee did. The employee’s own sandboxed computer is where it works; your systems are where it asks. Our security checklist walks through the same questions for any agent, ours or not.
§ 09What we are watching for
- Anthropic’s statement, if one comes: the Journal reported that Anthropic declined to comment.
- An OpenAI post-incident note beyond the one-line statement to the Journal (it narrowed permissions on community sign-in tokens and revoked affected tokens and sessions, per the coverage; we have not seen an OpenAI page carrying it).
- Hacktron’s HEIF Heist disclosures for Slack, Meta, GitHub Enterprise and the Node.js frameworks, which the write-up says are coming.
- Whether Codex and other coding agents add narrower default scopes for connected repositories.
§ 10Update log
This is a living page; when the story moves, the update lands here.
As of September 18, 2026, 20:30 UTC: page opened, from Hacktron’s September 13 write-up read in full and the September 18 coverage graded against it. No statement from Anthropic; OpenAI’s one-line statement is reported by the Journal and others.
§ 11Sources
- Hacktron AI, Hacking OpenAI: a heap overflow and SSO misconfiguration to compromise OpenAI internal repositories, Harsh Jaiswal, Mohan Pedhapati and Rahul Maini, September 13, 2026 (datePublished in the page metadata), read September 18, 2026. All quotations and times are from this page.
- @HacktronAI on X, September 18, 2026, 03:55 UTC; @S1r1u5_, 02:43 UTC; times computed from the post ids.
- Discourse, security advisory GHSA-vhm9-85gw-x335, July 28, 2026.
- Debian, DSA-6417-1 libheif security update, August 8, 2026, as cited by Hacktron.
- The Wall Street Journal, Hackers Used Anthropic’s Claude to Break Into OpenAI, September 18, 2026 (paywalled; OpenAI’s statement and Anthropic’s no-comment as reported there and by TechCrunch, 14:00 UTC).
Q1Who are the researchers who hacked OpenAI?
Harsh Jaiswal, Mohan Pedhapati and Rahul Maini of Hacktron AI, an AI security company that sells PR security review and penetration testing. Their write-up, Hacking OpenAI, is dated September 13, 2026 and credits Sudanshu Rajhbhar with technical assistance. The same team’s wider project, which they call HEIF Heist, traced the libheif bug across Slack, Meta, GitHub Enterprise, Ruby on Rails and several Node.js frameworks over two months.
Q2What is the libheif vulnerability?
A heap buffer overflow in libheif, the open-source library that decodes HEIC and HEIF images, the format iPhones shoot by default. Discourse passed HEIF uploads to ImageMagick, which used libheif, so an uploaded image reached the vulnerable parser directly. The fix existed upstream since the previous year but was not marked as a security fix and had no CVE, so Debian 12 and 13 shipped vulnerable versions (1.19.7 and 1.19.8). Debian published its security update on August 8, 2026; libheif’s latest security release as of September 14 is v1.23.4.
Q3Did the researchers steal OpenAI's code?
No. Hacktron’s write-up says the team proved access without allowing itself to learn any sensitive information: it sent a prompt to the compromised employee’s Codex to open one pull request in the internal monorepo, PR #1186742, and then stopped. Headlines describing access to OpenAI’s algorithmic secrets describe what the account could reach, not what the researchers read.
Q4How did OpenAI respond?
Per Hacktron’s timeline, the report went in through Bugcrowd between 08:00 and 10:00 UTC on July 25, and OpenAI confirmed the sign-in issue fixed at 22:49 UTC the same day, about 14 hours later. On September 1 OpenAI marked the report resolved and paid a $6,500 bounty, adding that the award recognizes the OpenAI-side finding, not the actions against Discourse.
Q5What does this mean for a business running AI agents?
The payoff of the whole chain was one employee’s coding agent with GitHub attached. Whatever your agents can write to is your blast radius, and a stolen session inherits it. The practical checks are scope (which tools each agent holds), approvals (which actions need a human before they land) and a record of what every agent did. CellCog AI employees run with owner-controlled approvals on every command that reaches your world: your machine, your real browser, your connected tools. Try it free, no credit card needed.