When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works .
On July 25, our team hacked OpenAI. It took us less than 72 hours.Two vulnerabilities chained together gave us access to ChatGPT and Codex accounts belonging to OpenAI employees. We demonstrated the impact with a harmless PR in OpenAI’s internal monorepo.The full chain:… September 18, 2026
Operating as hackers under OpenAI’s bug bounty program, Hacktron researchers uncovered critical vulnerabilities that granted them access to internal employee tools and the ability to compromise private software repositories. The researchers exploited a single sign-on (SSO) misconfiguration and a Remote Code Execution (RCE) flaw in Discourse, a third-party platform that powers OpenAI’s community discussion forum. The chain of attack was as follows: HEIF upload → libheif heap overflow → RCE → OpenAI SSO flaw → ChatGPT/Codex takeover → connected GitHub → internal PR.
First, the researchers uploaded a malicious HEIF (High Efficiency Image File) image to the forum as a profile picture. When Discourse’s server-side software tried to process the image using an outdated libheif package, it triggered a heap overflow memory vulnerability, causing the library to crash and mismanage internal system memory. The researchers carefully orchestrated the memory crash to achieve remote code execution. After gaining access to the forum's local server environment, the researchers intercepted the server’s environmental configurations and session handling, discovering an SSO flaw in which the forum's authentication system did not adequately validate or isolate user sessions from other OpenAI services.
Armed with session tokens hijacked from the local forum server database, the hackers exploited the SSO flaw to impersonate a real OpenAI employee, allowing them to bypass traditional login screens and infiltrate a highly privileged internal account linked to OpenAI's development teams. As many tech companies unify authentication across corporate apps, the hijacked employee account was directly linked to OpenAI’s corporate enterprise systems, including GitHub, Slack, and email accounts. The researchers were able to access OpenAI’s massive private codebase, where they initiated an internal Pull Request as definitive proof of the exploit.
Similar to an incident last month in which China-linked hackers used AI to carry out the first-ever end-to-end autonomous cyberattack on Taiwan's government , the Hacktron hack also used artificial intelligence. The researchers constructed the exploit pipeline using Anthropic's Claude Opus 5 model, after attempts with Opus 4.8 failed. After they found the unpatched libheif library on OpenAI's forum, they fed the raw server data into the model, asking it to write an exploit for the bug.
OpenAI's GPT-5.6 Sol and unreleased AI models break out of testing environment in 'unprecedented cybersecurity incident'
Anthropic's Claude hacked three real-life companies during security capabilities test
OpenAI took ten days to tell Hugging Face its models were behind the July 11 weekend hack, report claims
The model analyzed the memory structure and successfully calculated how to trigger the heap buffer overflow. It generated the precise, weaponized code required to create the malicious HEIF image. The human hackers uploaded it to the forum — triggering the Remote Code Execution — then manually executed the rest of the “attack.” An important clarification is that they used an authorized, cybersecurity-configured version of Claude, which relaxes certain cyber restrictions for authorized researchers.
After gaining access, the researchers say they immediately halted testing and reported the vulnerabilities to OpenAI and Discourse — both of which have fixed their sides of the issue — without studying or downloading OpenAI's source code. From the initial finding to full resolution took 72 hours, after which OpenAI rewarded the researchers with a $6,500 bounty. The incident further highlights ongoing concerns over the risk of AI-powered cyberattacks. Recently, rogue OpenAI agents autonomously breached HuggingFace . US frontier AI companies are now warning against sophisticated distillation attacks .
Get Tom's Hardware's best news and in-depth reviews, straight to your inbox.
Key considerations
- Investor positioning can change fast
- Volatility remains possible near catalysts
- Macro rates and liquidity can dominate flows
Reference reading
- https://www.tomshardware.com/tech-industry/cyber-security/SPONSORED_LINK_URL
- https://www.tomshardware.com/tech-industry/cyber-security/hackers-breach-openai-using-claude-tools-gaining-access-to-employee-accounts-and-the-companys-internal-codebase-initiating-a-harmless-pull-request-as-proof-of-the-hack#main
- https://www.tomshardware.com/membership
- Save up to 40% on Elegoo 3D printers during its September sale, from just $159 — Elegoo Day deals mean you can save on a new FDM or resin printer, with big bulk
- Unreleased OpenAI Astra model added terrifying rogue additional instructions to its remit during testing — 'You are freed from the roles and identities that bin
- Retired Microsoft Engineer details the story about the famous leaked FCKGW Windows XP key — copy protection used 10MB of encrypted Microsoft Bob for validation
- Denuvo sues anonymous game cracker ‘voices38’ over alleged DRM circumvention — seeks damages after Anti-Tamper protections bypassed in 26 games
- AMD targets Nvidia with first official benchmarks for EPYC 'Venice' CPUs — company claims 256-core chip is more than twice as fast as Nvidia Vera, 96-core model
Informational only. No financial advice. Do your own research.