Three security researchers at Hacktron AI discovered a memory-corruption flaw in a widely used image library and handed the job of turning it into a working exploit to Anthropic's Claude Opus 5. The model produced a functioning ARM64 exploit in roughly three hours, and within 72 hours the team had gained access to OpenAI's private code repositories through the company's user forum. Hacktron AI published an account of the incident on its website this week, detailing how AI-assisted exploitation moved from theoretical concern to demonstrated capability.
The attack chain began with a heap buffer overflow in libheif version 1.19.7, the library that ImageMagick uses to decode HEIC and HEIF image files. The flaw existed in the Debian 12 base image running community.openai.com, OpenAI's user forum built on Discourse software. A fix had been committed upstream the year before, but because it wasn't documented as a security patch and never received a CVE identifier, it never triggered a backport into the Debian package the forum relied on. The researchers adapted the exploit for the x86-64 architecture and jemalloc configuration Discourse uses, and a malformed HEIC image was sufficient to trigger remote code execution. Discourse later confirmed the vulnerability in a security advisory, rating the upstream libheif flaw—CVE-2026-32882—8.8 out of 10 on the CVSS severity scale.
But code execution on the forum was just the first step. Hacktron then identified a flaw in OpenAI's single sign-on system: sign-in tokens issued for the forum carried excessive permissions, granting full API access to the linked ChatGPT and Codex accounts. Some of those accounts belonged to OpenAI employees, and one employee's Codex account was connected to OpenAI's GitHub environment, opening a path to the company's private repositories. Using Codex, the team made a harmless documentation change against OpenAI's private monorepo and opened a pull request—enough to prove the access was real. The report states other accounts could have exposed connected services including Slack and email. OpenAI has since narrowed the permissions on community sign-in tokens and revoked the affected tokens and sessions, and paid Hacktron a $6,500 bounty for the account-takeover flaw.
The entire OpenAI intrusion was one thread in a broader project the team called "HEIF Heist," a roughly two-month sweep of image-processing infrastructure across multiple major technology platforms that consumed less than $3,000 in model tokens. Memory-corruption exploitation has historically been specialist work, involving memory layouts, allocators, operating system internals, and protections designed to make exploitation unreliable. Hacktron's run signals that a meaningful share of that work can now be delegated to AI. The team also ran the experiment again with Claude in an autonomous agent loop—giving it a goal, a target, and time to keep working—pointed at a Discourse instance of their own. The model achieved remote code execution on its own, demonstrating success by reading /etc/hosts from inside the container. Getting it started required one piece of misdirection: Opus refused to write an exploit aimed at a live remote host, so the team proxied their own instance through a URL that made the target look like it was part of a capture-the-flag exercise. The demonstration suggests the line between security research and attack development is, from the model's perspective, partly a question of what you consider a target. For organizations running widely deployed software with unpatched or undocumented vulnerabilities, the margin between discovery and exploitation just collapsed from weeks to hours—and the skill barrier dropped with it.