Bug hunters used Claude to take over OpenAI staff ChatGPT accounts

Security researchers took over multiple OpenAI employees' ChatGPT and Codex accounts through the company's own community help forum, and used one of those accounts to open a pull request in an internal OpenAI repository, according to a writeup published on 18 September 2026 and reported by The Register.

The team from security firm Hacktron — Harsh Jaiswal, Mohan Pedhapati and Rahul Maini — said initial entry came on 25 July 2026 via community.openai.com, the forum OpenAI runs on the Discourse platform. "Until two months ago, any user or OpenAI employee logging into OpenAI's own help forum (community.openai.com) could have had their ChatGPT and Codex accounts taken over," the researchers wrote. Because users connect other services to ChatGPT and Codex, they said the theoretical reach of the attack was large, including GitHub, Slack and email.

The flaw came down to how images were handled. Discourse normally uses the FastImage library to check uploaded images, but FastImage did not support HEIF files in the affected setup. HEIF uploads instead went to ImageMagick, which used the libheif library to process them before conversion. "That exposed the underlying libheif parser directly to attacker-controlled files," the researchers wrote.

The researchers said they used Anthropic's Claude Opus 4.8 to find a heap buffer overflow in libheif, a memory-corruption bug, and tried to turn it into remote code execution. That attempt failed against Discourse's default configuration. After Anthropic released Claude Opus 5, the team used the newer model to generate an exploit script and achieved remote code execution on OpenAI's instance.

They reported the issue to OpenAI "immediately", according to the writeup, then demonstrated impact. "We then took over an OpenAI employee's account, whose Codex was connected to OpenAI's Github organization," they wrote. "To demonstrate impact without actually accessing any internal code, we sent a prompt to this employee's Codex account to open a PR for us in OpenAI's internal monorepo. Then we stopped any further testing."

The whole sequence, from first discovery to reaching the internal repository, took under 72 hours, The Register reported. OpenAI fixed the flaw within about 14 hours of the report being submitted, marked the issue resolved and paid the team $6,500 through its Bugcrowd bug bounty programme.

OpenAI set out limits on that payment in a comment shared by Hacktron. "To clarify the scope of that award: testing against the Discourse-hosted community.openai.com was explicitly excluded from our bug bounty program," the company said. "The award recognizes the OpenAI-side finding, not the actions against Discourse."

Discourse also shipped a fix that added sandboxing around image processing, and published a security advisory, GHSA-vhm9-85gw-x335, with patching and rebuild guidance.

Neither OpenAI nor Anthropic responded to The Register's requests for comment.

The researchers framed the exercise as a test of how far AI models can compress offensive security work. The Register reported that the hack took a few days of AI agent time and a few hours of human effort. "Work that once required a well-resourced team and months of effort can now be compressed into days," the researchers said. "Security assumptions must catch up with attacker capabilities."

The case is a reminder that agent products are only as contained as the accounts they are attached to. A forum login, a connected code assistant and an organisation's GitHub were, in this instance, links in the same chain.