WHO HACKED THE OPENAI?
Meet Harsh Jaiswal, Mohan Pedhapati, and Rahul Maini.
Three cybersecurity researchers from startup
@HacktronAI who breached OpenAI’s internal monorepo in under 72 hours using Anthropic’s Claude Opus 5.
No Ivy League degrees, no massive venture budgets—just raw skill, curiosity, and an agent loop.
Here is the exact breakdown of how they pulled it off
The hack didn’t start at OpenAI’s frontier models or core cluster.
It started at their developer support forum
community.openai.com.
The forum runs on open-source Discourse.
When users upload avatar images or attachments, Discourse normally uses FastImage.
But for .heic / .heif files, it falls back to ImageMagick, which delegates decoding to an underlying C library libheif.
The team spotted a critical heap buffer overflow in libheif v1.19.7.
The crazy part? Upstream maintainers had actually committed a fix months earlier, but never tagged it as a security advisory or filed a CVE.
Because of this "silent fix", package maintainers (Debian 12/13) never backported it, leaving Discourse’s Docker container wide open.
Memory corruption bugs usually take weeks of manual heap feng shui and ASLR bypasses to become weaponized.
• First attempts using Claude Opus 4.8 stalled on ASLR & jemalloc wrangling.
• On July 24, Anthropic dropped Claude Opus 5.
• Within ~3 hours in an agentic loop, Opus 5 generated a working ARM64 exploit and ported it to x86-64.
Full RCE inside the forum container by 06:00 UTC, July 25.
Forum RCE is bad, but usually isolated.
The real escalation was an OpenAI identity flaw.
The community forum uses "Sign in with OpenAI" via
auth.openai.com.
Because of an SSO misconfiguration, session tokens generated during forum logins were over-permissioned.
With container access, the researchers extracted tokens granting full account-takeover privileges across employee ChatGPT & Codex sessions.
To demonstrate maximum impact ethically—without reading proprietary model weights or touching sensitive IP
They accessed an OpenAI engineer’s account whose Codex had internal GitHub connector access.
They prompted Codex to create a benign pull request.
PR #1186742 was opened directly inside OpenAI’s private monorepo (openai/openai).
That was their mic drop. Testing was immediately halted.
The disclosure was 100% white-hat:
• Discovery to monorepo PR took <72 hours.
• The entire multi-month "HEIF Heist" research cost <$3,000 in tokens.
• OpenAI resolved the token issue within 14 hours and awarded a $6,500 bug bounty.
Key lesson: AI agents connected to enterprise tooling inherit ambient credentials. Secure the identity plumbing.