Independent security researchers gained access to OpenAI’s systems using Anthropic’s Claude model. According to an incident reported by The Wall Street Journal, Hacktron AI’s three-person team carried out the attack as part of OpenAI’s bug bounty program and reported its findings to the company. OpenAI awarded the researchers on the team $6,500.
The researchers linked two critical vulnerabilities to gain access to multiple OpenAI employees’ ChatGPT accounts and enter the company’s software. OpenAI said the issues had been fixed. Hacktron found a way into the system on July 25 through Discourse, third-party software running OpenAI’s community forum.
The starting point of the attack was images in HEIF or HEIC format uploaded to the forum. Discourse used the ImageMagick and libheif libraries to convert these files to JPEG. A memory bug in libheif made it possible to take over the server with a specially crafted image. The bug had been fixed months earlier but had not received a CVE number because it had not been officially reported as a security vulnerability. Hacktron said Discourse may therefore have continued using the vulnerable version.
The team said the Claude Opus 4.8 it used struggled to produce a working exploit, but successfully completed the same task a few hours after Anthropic released Opus 5. After gaining access to the Discourse server, the researchers found another vulnerability that allowed them to take over users’ ChatGPT and Codex accounts. These accounts included those of OpenAI employees; the researchers reported that they had compromised an employee account linked to OpenAI’s GitHub organization through Codex. Discourse released a fix on July 27.
The incident has raised concerns about the capacity of AI tools to be used in cyberattacks. Gray Swan CEO Matt Fredrikson said that the ability to access these tools for $200 per month increases the risk. Hacktron founder Mohan Pedhapati, meanwhile, said that AI reduces the expertise required to develop exploits and that work taking months can be reduced to days.
Why it matters
The incident shows that third-party software outside a company’s own security boundaries can also pose a critical risk to corporate accounts and source code. The fact that a flaw that had previously been fixed but had not been officially recorded as a security vulnerability could be exploited demonstrates that reporting vulnerabilities and keeping versions up to date are as decisive as patch management. The fact that AI tools accelerate the exploit development process reinforces concerns that the threshold of technical expertise required for such attacks may be lowered. At the same time, bug bounty programs provide a channel for researchers to report their findings to companies before they fall into the hands of attackers; however, whether these channels cover third-party components and employee accounts remains an open question.
Background
OpenAI is not a new name in the FikirPilot archive: over the past 90 days, we have published 67 news reports mentioning the name; the latest is dated September 19, 2026.