Indian-origin security researchers Harsh Jaiswal, Mohan Pedhapati and Rahul Maini turned a routine bug hunt into a demonstration of how far a single web vulnerability can travel inside a major AI company's systems. Their work was authorised security research conducted under responsible disclosure, not a malicious attack, and Hacktron AI later published the findings.
Key Highlights
- Three researchers went from a public forum post to OpenAI's private GitHub environment in under 72 hours.
- The entry point was a libheif image-decoding flaw on OpenAI's Discourse-based community forum.
- Claude accelerated exploit development but didn't act autonomously; humans directed each step.
- An SSO weakness let the breach spread from the forum into employee ChatGPT and Codex accounts.
- The lesson for CISOs: ask not whether an app is "critical," but what it can reach if compromised.
The chain started on OpenAI's public community forum, which runs on Discourse. The researchers found a weakness in the HEIC and HEIF image processing stack, tied to the libheif image decoding library, that could be triggered through user-controlled image uploads.
From there, the path moved through seven stages: the vulnerable libheif dependency, the Discourse forum itself, an OpenAI single sign-on (SSO) weakness, employee ChatGPT and Codex accounts, a connected GitHub integration, and finally OpenAI's internal repository.
Anthropic's Claude played a supporting role rather than an autonomous one. Claude Opus 4.8 analysed the installed libheif package, identified missing security fixes, and generated an initial exploit, though repeated attempts couldn't make it reliable under normal protections. After Claude Opus 5 was released on July 24, a new session produced a working ARM64 local exploit within three hours, which the researchers then adapted to the target environment.
The bigger issue, according to Hacktron, was identity architecture. The SSO weakness let a forum compromise cascade into access over ChatGPT and Codex accounts belonging to active users, including employees, some of which had integrations with GitHub, Slack, email and other connected services. One compromised Codex account was linked to OpenAI's GitHub organisation, letting the researchers create a harmless pull request inside OpenAI's internal monorepo, after which they stopped testing.
OpenAI awarded a $6,500 bug bounty for the findings, which chained two vulnerabilities together.
