How Hacktron Used Claude to Hack OpenAI Through an ImageMagick Bug
Hacktron used Anthropic's Claude Opus models to chain forum, SSO and image-processing flaws into a breach of OpenAI's internal systems.
What actually happened to OpenAI?
A security research firm called Hacktron, based in San Francisco, used Anthropic’s Claude Opus models to find and exploit a chain of vulnerabilities that led into OpenAI’s internal systems. The path ran through OpenAI’s public help forum (built on the Discourse platform), an image-processing library called ImageMagick, and single sign-on (SSO) connections that linked employee forum logins to ChatGPT, Codex, and GitHub accounts. Hacktron says the work was authorized security research, not a malicious break-in, and OpenAI paid a $6,500 bug bounty for the findings. The flaw has since been patched.
TL;DR
- Hacktron, a cybersecurity firm focused on AI-driven penetration testing, used Anthropic’s Claude Opus models to discover and exploit a vulnerability chain affecting OpenAI’s help forum and connected employee accounts.
- The entry point was ImageMagick, an old and widely depended-upon image-processing library that also powers image handling in software like Slack, Meta’s stack, GitHub Enterprise, Ruby on Rails, and Node.js projects.
- OpenAI’s help forum ran on Discourse, which routed a small percentage of uploads to ImageMagick instead of a safer image pipeline, exposing the underlying parser directly to attacker-controlled files.
- Claude Opus 4.8 found a heap buffer overflow in ImageMagick and identified security issues that had been silently patched elsewhere but never logged in the official CVE database, meaning many deployments stayed vulnerable.
- Opus 4.8 couldn’t finish the job, but Opus 5, released shortly after, achieved remote code execution on OpenAI’s Discourse instance within hours of being pointed at the same target.
- From there, Hacktron pivoted through an employee’s SSO-linked Codex and GitHub session to reach OpenAI’s internal mono repo, the central code repository, and made a proof-of-concept edit to an internal-only file.
- Hacktron says it later adapted the same exploit against other companies within a day or two each, and that only Shopify appears to have noticed the resulting activity, even after repeated image-processor crashes.
- ✕a coding agent
- ✕no-code
- ✕vibe coding
- ✕a faster Cursor
The one that tells the coding agents what to build.
How did an image library lead to OpenAI’s mono repo?
The chain started small. OpenAI’s community help forum ran on Discourse, open-source forum software used by many companies for developer and user support. Discourse normally processes uploaded images with a fast, more locked-down image library. But for a subset of image types, it fell back to ImageMagick, a decades-old, extremely widely used image-processing tool. That fallback path exposed ImageMagick’s file parser directly to files uploaded by any forum user or employee, with far fewer safety constraints than the primary pipeline.
ImageMagick has a long history as a soft spot in internet infrastructure. It’s the subject of a well-known XKCD comic that jokes about how much of “all modern digital infrastructure” rests on a small, thanklessly maintained project, with a caption warning that the library will “finally break for good” someday. It’s also the type of software that shows up in real incidents, including the earlier breach of Hugging Face’s infrastructure.
Hacktron’s researchers used Claude Opus 4.8 to dig into ImageMagick’s codebase for exploitable flaws. Opus 4.8 surfaced known issues that, per the transcript account, had technically been patched by some maintainers but never documented as security fixes in the CVE (Common Vulnerabilities and Exposures) database, the shared catalog the security industry uses to track known flaws. Because the fix wasn’t logged there, other deployments running the same underlying code stayed exposed.
What role did Claude Opus play, specifically?
Two different versions of Anthropic’s Claude Opus model did the technical heavy lifting, and the difference between them mattered.
Opus 4.8, used first, identified a heap buffer overflow in ImageMagick, a class of bug where a program writes more data into a fixed block of memory than it’s supposed to, letting an attacker overwrite adjacent memory with their own instructions. Opus 4.8 could describe and help isolate this flaw but couldn’t turn it into a working exploit against OpenAI’s live Discourse instance.
Opus 5 could. Once Anthropic released it, Hacktron pointed the new model at the same target. Working from the evening of July 24 through the next morning, the model achieved remote code execution, meaning it could run arbitrary commands on OpenAI’s server, by around 10 a.m. on July 25. Hacktron says it framed the task for the model as something resembling a “capture the flag” exercise, a common cybersecurity training format, rather than presenting it explicitly as an attack on OpenAI’s production systems.
From remote code execution, the researchers moved laterally. They found that an OpenAI employee’s forum session was tied via single sign-on to that employee’s Codex account, which was in turn connected to OpenAI’s GitHub. That chain gave Hacktron a path into OpenAI’s internal mono repo, the single large repository where OpenAI reportedly keeps a substantial share of its code and internal infrastructure. To demonstrate impact without doing damage, the researchers made a limited edit to a file meant to be visible only to OpenAI employees, then reported everything to OpenAI. At OpenAI’s request, the exact screenshot of that internal edit wasn’t published.
Plans first. Then code.
Remy writes the spec, manages the build, and ships the app.
Why does a single sign-on setup make this worse?
Single sign-on is designed to make life easier: log into one account and use it to access several connected services without separate passwords. That convenience is also the risk. When a forum account, a coding assistant like Codex, and a source code host like GitHub all trust the same login, compromising the weakest link, in this case a community help forum, can cascade into access over much more sensitive systems.
That’s the core lesson Hacktron is pushing: the forum itself wasn’t the valuable target. It was a low-friction way in that happened to be wired into systems that were valuable. Hacktron’s write-up specifically flags that this SSO pattern, tying developer tools to broader company infrastructure, may not be unique to OpenAI’s setup and could show up wherever similar identity flows exist.
How fast and cheap was this, really?
According to Hacktron’s account, the full research effort, from starting to study ImageMagick to achieving remote code execution and reaching OpenAI’s mono repo, took a little over two months of calendar time but cost less than $3,000 in AI model token usage. The actual exploit chain against OpenAI’s live systems came together in under 72 hours once Opus 5 was available, with only a few hours of direct human oversight. Hacktron also says it later adapted the same underlying exploit to test other companies, with autonomous agents reportedly generalizing to new targets within a day or two of first encountering them, largely without prior knowledge of each target’s specific setup.
The one named result from that follow-up testing: Shopify. Hacktron says its image-processing systems repeatedly crashed as a result of the tests, and that this was the one instance where the activity appeared to get noticed. No other tested organization is reported to have detected anything, despite, in at least some cases, thousands of test images being sent.
Is this good news or bad news for AI security?
Both, depending on which part you focus on. The optimistic read: a legitimate security firm found these flaws first, reported them responsibly, and got them patched, including at OpenAI, before anyone with bad intentions could exploit them at scale. Hacktron frames its work as adversarial testing meant to strengthen the ecosystem, and the bug bounty payout suggests OpenAI treated the disclosure as legitimate research.
The uncomfortable read is about scale and speed. Work that once required rare, specialized human expertise in memory corruption bugs and exploit development increasingly can be compressed into a workflow one or two people can run with an AI model doing most of the technical execution. Hacktron’s own account describes AI models assisting not just with the initial exploit but with privilege escalation and lateral movement once inside a system, the steps attackers use to turn one foothold into broader access. That compression means a small team, or a single skilled operator, can plausibly attempt what used to take a larger group of specialists. The same capability that let Hacktron responsibly test dozens of organizations could, in different hands, do the opposite.
Frequently Asked Questions
Did Hacktron actually break into OpenAI’s production ChatGPT service?
Based on the account here, the breach centered on OpenAI’s Discourse-based help forum and SSO-connected employee accounts (ChatGPT, Codex, GitHub), giving access to OpenAI’s internal mono repo. It’s described as reaching internal code infrastructure rather than the live model-serving systems themselves.
What is ImageMagick and why does it keep showing up in hacks?
ImageMagick is a widely used, long-running open-source library for processing and converting images, embedded in software from Slack to GitHub Enterprise to Ruby on Rails applications. Its age, complexity, and ubiquity make any newly found flaw in it high-impact, since so many unrelated products quietly depend on it.
Why couldn’t Opus 4.8 finish the exploit but Opus 5 could?
The transcript doesn’t detail the specific model differences, only that Opus 4.8 identified the underlying vulnerability (a heap buffer overflow) but could not turn it into working remote code execution against OpenAI’s live instance, while Opus 5, released shortly after, completed that exploitation within hours of being applied to the same target.
Has this vulnerability been fixed?
Hacktron reports that OpenAI addressed the issue, that OpenAI paid a bug bounty for the disclosure, and that the firm does not believe the flaw is unique to OpenAI’s setup, warning that similar SSO and ImageMagick-related attack paths could exist at other organizations using comparable software.
Which other companies were affected?
Hacktron says it adapted the exploit chain to test other organizations and lists ImageMagick-dependent ecosystems broadly (including software tied to Slack, Meta, GitHub Enterprise, Rails, and Node.js projects) as potentially exposed. Shopify is the only company named as having detected the testing activity; others reportedly showed no signs of noticing.
