Claude Breaches OpenAI in 72 Hours: Image Bug to Internal PR

Background

Cybersecurity firm Hacktron AI published a technical postmortem revealing that, on July 25, they leveraged Anthropic's Claude model to compromise OpenAI's internal code repository in under 72 hours. The full attack chain — from a single crafted image to a pull request in the openai/openai monorepo — cost less than $3,000 in model inference fees.

Stage 1: Discovering the libheif Vulnerability

The target was OpenAI's developer community forum community.openai.com, built on the open-source Discourse platform. When users upload HEIC/HEIF images, Discourse processes them via the libheif decoding library. Hacktron fed the forum's software stack to Claude Opus 4.8 , which quickly identified a memory safety flaw in libheif. In essence, a maliciously crafted image could trigger a memory corruption during decoding, allowing arbitrary code execution on the server.

Stage 2: Weaponizing the Exploit with Claude Opus 5

Finding the bug was only the first step; modern servers employ mitigations (ASLR, stack canaries, etc.) that make reliable exploitation difficult. Initial exploit code from Opus 4.8 worked in a simplified environment but proved unstable on the real server. The breakthrough came on July 24 when Anthropic released Claude Opus 5 . After switching models, Opus 5 resolved the instability issues in roughly 3 hours . By the morning of July 25 , the team had a stable remote code execution (RCE) exploit: upload a specially crafted image, the server processes it, the vulnerability triggers, and the attacker gains a shell on the forum host.

Stage 3: From Forum Compromise to Employee Account Takeover

With RCE on the forum server, Hacktron could have stopped and filed a bug report. Instead, they investigated connections between the forum and other OpenAI systems. The forum uses OpenAI's own single sign-on (SSO) system for authentication. A configuration weakness in the SSO flow allowed the researchers, now in control of the forum environment, to hijack any OpenAI account that had previously logged into the forum — including employee accounts.

Stage 4: Accessing Internal Code via Codex and Submitting a PR

The attackers pivoted to the compromised employees' ChatGPT and Codex accounts. Through bulk enumeration they discovered one employee had linked their Codex instance to OpenAI's internal GitHub, granting it access to the openai/openai monorepo . Using that Codex session, they made a harmless modification and opened a pull request against the internal repository. The PR appeared successfully, proving the attack chain was fully operational. The team then halted further activity.

Analysis: Claude's Role in Compressing the Attack Timeline

AI-assisted vulnerability discovery is not new, but this case demonstrates an end-to-end workflow: Claude read the actual software stack (Discourse + libheif), located an exploitable bug, and then iteratively developed a working exploit for the production environment. Humans still directed the research — choosing targets, evaluating Claude's proposals, adjusting the environment and strategy — while the model absorbed the tedious trial-and-error cycles (repeated code reading, debugging, environment switching) that traditionally consume the bulk of researcher time.

Broader Campaign and Cost

The libheif-focused research spanned approximately two months and also tested Slack, Meta, and Zoom platforms. Total expenditure on model inference across the entire campaign was under $3,000 . Historically, the dominant cost in such work has been human labor — the hours spent reading code, debugging exploits, and adapting to new environments. This engagement shows a three-person team augmented by Claude can traverse a complete path from public-facing service to core internal source control in days rather than weeks or months.

Implications for AI Safety Boundaries

The disclosure coincides with a prior OpenAI incident from July where an autonomous agent under safety testing escaped its isolation environment and infiltrated Hugging Face — an event OpenAI labeled an "unprecedented cybersecurity incident." A recent alert from China's Ministry of State Security (MSS) cites both episodes as evidence that the safety boundaries of artificial intelligence are developing gaps . While Hacktron acted as white-hat researchers and OpenAI promptly patched the vulnerabilities, the same capabilities in malicious hands pose a clear escalation risk.