Glonce

Claude helps researchers hack into OpenAI via Discourse bug

securityThe Glonce editorsThe Verge🔥72Glonce rating72Impact70Novelty55Relevance88Surprise65Players75Credibility85
Claude helps researchers hack into OpenAI via Discourse bug

A three-person team of independent security researchers at Hacktron says it took less than 72 hours to break into OpenAI employee accounts, using Anthropic's Claude Opus 4.8 and Claude Opus 5 to do it. The account comes from The Wall Street Journal's reporting, relayed by The Verge. The team got in through Discourse, the third-party service that hosts OpenAI's community forums, by exploiting a flaw in the way Discourse processes HEIF image files. According to Hacktron, Claude Opus 5 launched on the evening of July 24th, and by 10AM the next day the team had already used it to achieve remote code execution on Discourse Cloud and to access OpenAI's own instance of the forum software.

From that foothold, the researchers reached OpenAI's GitHub repository, internally called "Monorepo," which sources told The Wall Street Journal contain OpenAI's algorithmic secrets. The team says it stopped short of accessing the internal code itself, but sent a pull request from an OpenAI employee's Codex account to prove it had gained access.

Hacktron calls the technique the HEIF Heist project and says adapting it to a new target took only one or two days per company, using less than $3,000 in tokens across the effort. The team says it tried the same approach against other companies, including Slack, Meta, GitHub Ent, Rails, Next.js and ImageMagick, and that to its knowledge only one target, Shopify, detected the attack. The vulnerabilities Hacktron reported to Discourse and to OpenAI have since been fixed, and OpenAI paid Hacktron $6,500 for finding the bug. Hacktron CTO Mohan Pedhapati told The Wall Street Journal: "I don't think we are as strong as Chinese threat actors... We're just three guys with Claude and Codex subscriptions."

Key facts

  • A three-person Hacktron team broke into OpenAI employee accounts in under 72 hours using Anthropic's Claude Opus 4.8 and 5.
  • The entry point was a flaw in how Discourse, the third-party host of OpenAI's community forums, processes HEIF images; the team says it reached remote code execution on Discourse Cloud by 10AM the day after Claude Opus 5 launched on the evening of July 24th.
  • From there the team reached OpenAI's "Monorepo" GitHub repository, said to contain OpenAI's algorithmic secrets, and proved access by sending a pull request from an employee's Codex account rather than viewing the code itself.
  • The same HEIF Heist technique was adapted to other companies, including Slack, Meta, GitHub Ent, Rails, Next.js and ImageMagick, in one or two days each for under $3,000 in tokens total, and Hacktron says only Shopify detected it.
  • Discourse and OpenAI have fixed the reported vulnerabilities, and OpenAI paid Hacktron a $6,500 bug bounty.

Why it matters

The story is a live demonstration that a current frontier model can meaningfully speed up offensive security work: a three-person team says it went from a fresh Claude Opus 5 release to remote code execution on a production system in under a day, and then reused the same technique against a string of other companies in a day or two each. That collapses the time and headcount an attack like this used to need, and it happened against OpenAI itself, through infrastructure (Discourse) that many companies, including AI labs, rely on for community forums.

Who it affects

OpenAI is the named target, since the attack reached its GitHub "Monorepo" and an employee's Codex account. Discourse is directly implicated as the vendor whose HEIF image handling carried the flaw. Hacktron names Slack, Meta, GitHub Ent, Rails, Next.js and ImageMagick as other companies it tested the same technique against, with Shopify the only one, to Hacktron's knowledge, that caught it. Anthropic is affected only in that its Claude models were the tool used, not a target.

How to use it

There is no product here to license or buy: Hacktron reported the flaws through OpenAI's and Discourse's bug bounty channels, and both have since fixed the vulnerabilities it found, so the immediate exposure the report describes is closed. Discourse operators and any company that lets users upload HEIF images through similar pipelines are the ones with something concrete to check, since Hacktron says the same approach adapted quickly across unrelated codebases.

How solid is it

The account rests on The Wall Street Journal's reporting, relayed here by The Verge, and is built largely from Hacktron's own description of its work, including an on-record quote from CTO Mohan Pedhapati. The article does not say that OpenAI independently confirmed the details of how far the team got or what it accessed, so the specifics of the intrusion are Hacktron's account of Hacktron's own actions, checked by a WSJ reporter rather than by OpenAI.

Risks and caveats

Several details are left open: the article does not name the specific HEIF-processing vulnerability beyond calling it an issue with how Discourse handles those images, does not say whether the pull request sent from the employee's Codex account was ever merged, does not give a complete list of companies affected beyond the ones named, does not say when OpenAI's $6,500 payment came relative to the hack, and does not name Hacktron's other two team members besides Pedhapati. The claims about the Monorepo repository's contents are attributed to unnamed Wall Street Journal sources, not confirmed by OpenAI in the text.

“I don't think we are as strong as Chinese threat actors... We're just three guys with Claude and Codex subscriptions.”

— Mohan Pedhapati, Hacktron CTO