Claude-Generated Exploit Chained to Hijack OpenAI Accounts and GitHub Repos

Security researchers from Hacktron have demonstrated how quickly advanced AI models can accelerate complex exploitation chains, using Anthropic’s Claude to compromise OpenAI employees’ ChatGPT and Codex accounts. By combining an image-parser memory corruption vulnerability with downstream session hijacking, the team gained unauthorized access to OpenAI’s internal monorepo within a 72-hour window.

The attack highlights two major shifts in the threat landscape: the rapid compression of vulnerability research timelines via agentic AI models, and the compounding blast radius of developer tool integrations across linked cloud environments.

How the Exploit Chain Unfolded

The attack vector targeted OpenAI’s public community forum at community.openai.com, which runs on the open-source Discourse platform. Under normal operation, Discourse relies on FastImage to process uploaded images. However, when presented with HEIF (High Efficiency Image File) uploads—a format unsupported by FastImage in this configuration—Discourse fallback rules routed the files to ImageMagick, which in turn passed the data directly to the underlying libheif C++ parsing library.

This fallback mechanism exposed an unauthenticated, attacker-controlled file directly to libheif’s memory handling routines. Hacktron researchers Harsh Jaiswal, Mohan Pedhapati, and Rahul Maini leveraged Anthropic’s Claude Opus 4.8 model to identify a heap buffer overflow vulnerability in libheif. While Opus 4.8 was able to map the flaw, it could not initially produce a reliable Remote Code Execution (RCE) payload against Discourse’s default configuration.

The release of Claude Opus 5 provided the missing piece: the updated model generated a working exploit script capable of executing arbitrary code on the Discourse host environment.

Once RCE was established on the forum server on July 25, the researchers escalated their access by hijacking session state and authentication tokens for an OpenAI employee whose ChatGPT and Codex accounts were active on the platform. Because Codex was connected directly to OpenAI’s GitHub organization, the researchers were able to issue a prompt through the compromised employee’s Codex interface instructing it to open a pull request in OpenAI’s internal monorepo, proving full end-to-end access without exfiltrating proprietary code.

The Mechanics of Heap Buffer Overflows in Media Parsers

Media parsing libraries written in memory-unsafe languages like C and C++ remain prime targets for remote execution. A heap buffer overflow occurs when an application writes more data into a memory allocation on the heap than the buffer was designed to hold. In complex file formats like HEIF, parser bugs frequently stem from integer overflows in chunk size calculations, missing bounds checks on nested atom headers, or improper pointer arithmetic during decompression.

When an unauthenticated attacker uploads a malformed image, the parser allocates a heap chunk based on header metadata, but subsequent copy operations overflow that allocation, corrupting adjacent heap metadata or adjacent control structures. Attackers use this corruption to achieve arbitrary write primitives—overwriting function pointers, vtables, or allocation control blocks—to hijack the process control flow and execute arbitrary code in the context of the web server user.

In web applications like Discourse, executing code within the application process provides immediate access to local configuration files, environment variables, database credentials, and cached session tokens. For platforms using single sign-on (SSO) or unified account linking across developer tools, an RCE on an isolated web application quickly cascades into full identity compromise.

Blast Radius and Downstream Risks

The realistic blast radius of this vulnerability chain stems from the central role AI coding assistants and unified identity tokens play in modern software development. When developer environments tie platforms like ChatGPT, Codex, GitHub, Slack, and internal corporate email together via OAuth or continuous integration pipelines, compromising a single user session breaks the trust boundary surrounding the developer’s entire workstation profile.

Had this exploit chain been deployed by a malicious threat actor rather than ethical bug bounty hunters, the impact could have included:

• Direct injection of malicious code or backdoors into internal source code repositories via compromised developer AI agents.
• Mass exfiltration of proprietary model weights, source code, and internal communications.
• Silent persistence inside build systems by abusing authorized API keys linked to Codex and GitHub integrations.

Response and Remediation

The researchers submitted their findings directly through OpenAI’s bug bounty program on Bugcrowd. OpenAI acted swiftly, mitigating the vulnerability within approximately 14 hours of receiving the initial report. Despite testing on community.openai.com being out-of-scope for the primary bounty program, OpenAI awarded the Hacktron team a $6,500 reward specifically for demonstrating the secondary impact against OpenAI’s internal GitHub environment.

Upstream software vendor Discourse resolved the underlying parser exposure by implementing stricter image-processing sandboxing and releasing security advisory GHSA-vhm9-85gw-x335.

To mitigate risks associated with image parsing and developer token compromise:

1. Apply Discourse Updates: Organizations running self-hosted Discourse instances should apply the latest security updates referenced in advisory GHSA-vhm9-85gw-x335 to enforce media parser sandboxing and eliminate direct file handling by legacy libraries.
2. Isolate Media Processing: Ensure web applications process untrusted media files (HEIF, ImageMagick, ffmpeg pipelines) inside short-lived, unprivileged, isolated containers or WebAssembly sandboxes lacking access to host environment tokens or network sockets.
3. Restrict Developer Token Scopes: Restrict OAuth and API scope permissions granted to AI assistants like Codex and ChatGPT. AI integrations should require explicit secondary confirmation before creating pull requests, reading private code repositories, or executing commands in internal monorepos.