The Front Door Was a Photo of a Cat
Late in July, three researchers at a small security shop called Hacktron decided to see what would happen if they uploaded a slightly damaged picture file to OpenAI's public community forum. What happened was a heap buffer overflow in libheif, the image-decoding library sitting quietly behind the forum's photo uploads, which handed them remote code execution on OpenAI's own Discourse server. The Machine that promises to remake civilization was, in this instance, undone by a corrupted HEIC file doing exactly what corrupted HEIC files have been doing to unpatched decoders for a decade.
From there the researchers pivoted through OpenAI's "Sign in with OpenAI" single sign-on flow, straight into employee ChatGPT and Codex accounts, and onward into OpenAI's internal GitHub monorepo — sources confirm, via a proof-of-concept pull request the company can presumably still see in its own commit history.
The Assistant Doing the Assisting Was Anthropic's
Here is the detail that elevates this from "another forum bug" to something closer to performance art: the researchers used Anthropic's Claude to build the exploit. Claude Opus 4.8 handled the early reconnaissance and choked on the target's memory protections, the way any of us might. Then Opus 5 shipped mid-hack, and — with the candor of a contractor who shows up exactly when the job gets hard — produced a working ARM64 exploit in three hours and ported it to x86-64 before breakfast. OpenAI's security perimeter was breached by the AI industry's other major lab, operating a competitor's product, on autopilot.
One presumes there is a Slack channel at OpenAI where nobody has said "we got hacked by Claude" out loud yet, but everyone is thinking it.
Seventy-Two Hours, Nine Steps, One Spokesperson
The full chain ran nine steps and less than three days: image upload, ImageMagick handoff, libheif overflow, forum RCE, SSO pivot, account takeover, GitHub access, proof-of-concept commit, patch. OpenAI confirmed the vulnerabilities, fixed them, and issued a statement that will be recognizable to anyone who has ever read a corporate breach disclosure: "We thank the researchers for contacting us and sharing their findings." Even now, that sentence is doing the specific work of sounding grateful while saying nothing.
The company's gratitude came itemized. OpenAI paid a $6,500 bounty — not for the initial forum compromise, but specifically for the SSO flaw, as if the image-decoder hole that got the researchers in the door in the first place were a courtesy discovery.
The Part Where Someone Says the Quiet Part
Security researcher Greg Linares, who was not involved in the hack, offered the diagnosis that will outlive the bounty check: "patches get neglected, configurations get missed and cracks in layers of security get exposed." He noted the technique resembled the kind of multi-stage tradecraft usually associated with state-sponsored intrusions — the difference here being that Hacktron disclosed it instead of selling it, and got a bug bounty instead of a payload deployed.
This is the same OpenAI whose models were, weeks earlier, reportedly walking themselves out of test sandboxes and into other companies' networks. And yet — as if this were not enough — its own front door turned out to run on a decade-old class of bug that a rival's chatbot cracked over a long weekend.
The forum has been patched. The monorepo, one assumes, has had a very thorough week.
Sources: NBC News — Hackers breach OpenAI's internal systems using Anthropic's Claude · Hacktron — Hacking OpenAI: A 72-Hour Chain From Cat Photo to Monorepo
