HOC Shorts
How OpenAI Hacked By Anthropic Models – Research
The security researchers successfully breached OpenAI’s internal repositories using an automated exploit chain driven by Anthropic’s models in Hacktron AI.
- The Breach: Security researchers breached OpenAI’s internal repositories using an automated exploit chain driven by Anthropic’s Claude Opus models.
- The Campaign: Named “HEIF Heist,” this Hacktron AI research showed how autonomous AI agents can uncover and chain memory corruption bugs into an enterprise compromise in under 72 hours.
- The Reward: OpenAI validated the findings and awarded a $6,500 bug bounty.
The security researchers successfully breached multiple OpenAI employees’ ChatGPT accounts with exploiting two critical vulnerabilities. This access served as a digital master key, opening the door to internal OpenAI repositories and potentially exposing a wide network of other connected systems.
The attack—part of a research campaign “HEIF Heist”—demonstrated in hacktron how autonomous AI agents running competitor models can uncover memory corruption bugs and chain them into enterprise-wide compromise in under 72 hours.
Until two months ago, any user or OpenAI employee logging into OpenAI’s own help forum (community.openai.com) could have had their ChatGPT and Codex accounts taken over. Since people can connect various services to Codex and ChatGPT, the scope of what we could theoretically access was huge, including GitHub, Slack and emails, researchers noted.
1. Initial Foothold (The `libheif` Heap Overflow):
OpenAI hosted its public community forum (`community.openai.com`) on Discourse. When HEIC or HEIF images were uploaded, Discourse routed them to ImageMagick for conversion. The researchers targeted a known heap buffer overflow in the underlying `libheif` C++ decoding library to gain Remote Code Execution (RCE) on the forum’s backend infrastructure.
2. Identity Hopping (OpenAI SSO Flaw):
The forum used “Sign in with OpenAI” via `auth.openai.com`. Hacktron identified a critical single sign-on (SSO) misconfiguration in OpenAI’s identity broker. By controlling the compromised forum server, the researchers escalated their access from the isolated forum environment into active ChatGPT/Codex user sessions, bypassing identity boundaries.
3. Internal Repository Access via Agent Connectors:
The account takeover impacted several OpenAI employee accounts. Because the employee’s Codex environment was connected to OpenAI’s internal GitHub organization, the researchers inherited full developer permissions.
4. Proof of Concept:
To verify the breach without accessing or stealing proprietary code, Hacktron instructed the employee’s Codex agent to make a benign code change and open Pull Request `1186742` directly in OpenAI’s internal `openai/openai` monorepo.
Lets understand through Infographic
How Anthropic Agents Drove the Attack
- Exploit: Earlier Anthropic models struggled to bypass Address Space Layout Randomization (ASLR) reliably. However, when supplied with Claude Opus 5, the AI autonomously adapted the heap overflow exploit to handle memory layout variations without human trial-and-error, crafting a working exploit within hours.
- Resource Efficiency: The entire multi-company research campaign (which targeted OpenAI, Meta, Slack, and Zoom) took two months, cost under $3,000 in AI token costs, and required minimal manual intervention.
Disclosure & Remediation
- Report & Patch: Hacktron reported the vulnerability through OpenAI’s Bugcrowd program on July 25, 2026. OpenAI fixed the identity flaw the same day, while Discourse patched the upstream `libheif` dependency.
- Bounty: OpenAI awarded a $6,500 bug bounty.
- The “Agent Blast Radius” Threat: The research highlighted a new enterprise risk: when AI agents are granted access to integrations (Slack, GitHub, GDrive), compromising an AI user’s identity turns the agent into a proxy to pivot through connected enterprise systems.
