A three-person cybersecurity research team used Anthropic’s Claude Opus 5 to exploit vulnerabilities in an OpenAI community forum, take control of employee accounts and demonstrate access to the company’s private code repository.
The operation began on July 23 and was carried out by researchers from Hacktron AI, who disclosed the vulnerabilities to OpenAI and stopped testing without examining the company’s source code.
The Wall Street Journal, which interviewed the researchers and first reported the incident, said OpenAI paid the team $6,500 for its discovery.
The researchers reported the OpenAI-side vulnerability through the company’s bug-bounty programme. Testing of the third-party forum software itself, however, was outside the scope of OpenAI’s bounty programme.
Read: OpenAI’s rogue agents probed Hugging Face for weaknesses two months before major hack
The researchers, Harsh Jaiswal, Mohan Pedhapati and Rahul Maini, published a detailed technical account explaining how they combined a flaw in the software behind OpenAI’s community forum with a separate problem in the company’s sign-on system.
The attack began at community.openai.com, a help forum powered by the third-party discussion platform Discourse.
Hacktron found that certain uploaded image formats were processed through ImageMagick and a vulnerable version of the image-decoding library libheif. The vulnerability allowed specially prepared image data to trigger remote code execution, meaning an attacker could potentially run commands on the forum’s server.
A separate identity-management flaw then allowed the researchers to move from a compromised forum session to ChatGPT and Codex accounts belonging to active forum members, including OpenAI employees.
Because those accounts could be connected to other services, the potential reach extended to platforms including GitHub, Slack and Outlook, according to Hacktron.
Read more: OpenAI, Anthropic and Google are working to create an AI standards body
To demonstrate the impact without reading confidential material, the researchers instructed a compromised employee’s Codex account, which was connected to OpenAI’s GitHub organisation, to open a harmless pull request in the company’s private “openai/openai” monorepo, the central digital vault housing the core source code for all its AI systems
The team said it stopped testing immediately afterwards and updated its report to OpenAI.
