Researchers use Claude to expose OpenAI flaw and receive $6,500 reward

Three experts from Indian startup Hacktron AI exploited a vulnerability in the Discourse forum. With the help of Anthropic’s AI model, Claude, they gained access to OpenAI employee accounts and the company’s private code repository, known internally as “Monorepo.”

The initial breach was a heap buffer overflow error in the libheif library, which Discourse uses to decode HEIC and HEIF image formats. The servers were running an outdated, vulnerable version of the library. The team began analyzing the image pipeline on July 23 and had a working exploit by the next day. However, it only functioned with ASLR protection disabled, making it difficult to replicate in a real-world environment.

Claude Opus 4.8 repeatedly attempted to create an exploit capable of bypassing ASLR but failed. On the evening of July 24, Anthropic released Opus 5, which successfully overcame this obstacle, allowing the researchers to proceed with the attack.

Using access to a ChatGPT account and a staff member’s Codex, the researchers reached OpenAI’s private GitHub repository. Instead of examining sensitive code, they submitted only a harmless pull request (number 1186742) to prove the vulnerability existed. Mohan Pedhapati of Hacktron AI told the Wall Street Journal, “We’re just three guys with Claude and Codex subscriptions,” and that the entire process took only a few days of AI agent work and a few hours of human effort.

Reward and context of the attack

OpenAI paid a $6,500 reward (approximately R$33,000) for the discovery. The project cost less than $3,000 in AI tokens.

HEIF Heist: a broader investigation

The attack on OpenAI was part of a larger Hacktron AI campaign called “HEIF Heist,” which focused on vulnerabilities in image file processing across various services. The same technique had previously been used to identify flaws in platforms like Slack, Zoom, and Meta. The project lasted two months, involved three researchers, and cost less than $3,000 in AI tokens.

In their findings, the researchers warned that AI is eliminating traditional security measures based on software complexity, transforming specialized knowledge into computational power. Tasks that once required well-funded teams and months of effort can now be completed in days. They argued that security assumptions must evolve to keep pace with attackers’ capabilities.

Growing concern in the industry

This incident is the latest in a series of publicly disclosed security issues involving OpenAI and Anthropic. Both companies have advocated for safeguards that allow AI to advance without sacrificing human risk assessment before new models are released to the public. Recently, Anthropic CEO Dario Amodei called for a coordinated slowdown in the development of frontier AI.