Two co-founders of Indian security startup Hacktron AI, Mohan Pedhapati and Harsh Jaiswal, successfully breached the ChatGPT account of an OpenAI employee using Anthropic's Claude model, gaining write access to OpenAI's private code repository and even submitting a real pull request as proof of concept. This incident has been independently verified by The Wall Street Journal and disclosed in September 2026.

The entry point of the attack chain was the Discourse system used by the OpenAI community forum community.openai.com: Researchers discovered a vulnerability in the HEIC/HEIF image upload feature of the forum, stemming from a heap buffer overflow in the underlying libheif library, which could be triggered through the ImageMagick image processing pipeline. Discourse rated this vulnerability with a CVSS score of 8.8 (out of 10), indicating a high severity level.

After breaching the forum environment, the researchers exploited another independent flaw in OpenAI's Single Sign-On (SSO) implementation to escalate permissions from the forum account to the employee's ChatGPT and Codex accounts. Since this account was linked to multiple third-party connectors, it theoretically could further access downstream services like GitHub, Slack, Outlook, Gmail, and Google Drive. The researchers ultimately chose to demonstrate their write access by submitting a harmless pull request to OpenAI's internal openai/openai main code repository.

Claude played a key role in generating the exploit code throughout the attack chain: Initially, the researchers attempted to bypass Address Space Layout Randomization (ASLR) protection using Claude Opus 4.8 but were unsuccessful. After switching to the newly released Claude Opus 5 on July 24, they generated usable ARM64 exploit code within hours, which was later adapted for x86-64 architecture and the jemalloc memory allocation environment. The entire process from discovering the vulnerability to gaining access to the code repository took less than 72 hours.

The research team submitted a report through OpenAI's bug bounty program on Bugcrowd, and OpenAI confirmed the fix on the same day (July 25). OpenAI ultimately paid the research team a bounty of $6,500. OpenAI stated that the researchers "did not view sensitive information" during the process, and the company subsequently completed an internal security review and patched the related vulnerabilities, also launching a new "dislocated behavior incident" reporting framework to expedite and systematize such security disclosure processes.

The real highlight of this incident is not the vulnerability itself, but the speed at which the attack chain was compressed—historically, bypassing ASLR protection and writing usable architecture-level exploit code typically required experienced security researchers several days or longer. This time, aided by the updated Claude Opus 5 model, a critical step that older models could not achieve was completed within hours. The beneficiaries are white hat security teams and bug bounty hunters proficient in leveraging cutting-edge models for offense and defense; the pressure is on all tech companies, including OpenAI, that rely on forums, SSO, and third-party connectors to build internal collaboration environments, as their attack surface is systematically amplified by the code generation capabilities of AI models.

Current public information indicates that the Discourse vulnerability and SSO flaw involved in this incident have been patched by OpenAI, and the researchers used the Claude Opus 5 model released by Anthropic in July, while the earlier version, Claude Opus 4.8, failed at a critical stage of the same attack chain.

Source: Public information