Table of Contents
- Introduction
- What Happened: The 72-Hour Hack
- The Attack Chain: From HEIF File to Internal Repo
- Claude's Role: AI-Accelerated Exploit Development
- Full Timeline of the Attack
- Why This Matters for Every Business
- Why Businesses Rely on Managed IT Services for This
- What Businesses Should Do
- Final Thoughts
Introduction
In one of the most ironic security stories of the year, a trio of bug hunters used Anthropic's Claude to help hack into OpenAI employees' ChatGPT accounts.
The researchers — Harsh Jaiswal, Mohan Pedhapati, and Rahul Maini of Hacktron — chained two vulnerabilities to take over multiple OpenAI employees' ChatGPT accounts, then used that access to demonstrate they could reach an internal OpenAI repository by opening a harmless pull request.
This blog is based on reporting by Jessica Lyons (September 18, 2026). Neither OpenAI nor Anthropic responded to The Register's requests for comment.
What Happened: The 72-Hour Hack
Until two months ago, any user or OpenAI employee logging into OpenAI's help forum (community.openai.com) could have had their ChatGPT and Codex accounts taken over.
"Since people can connect various services to Codex and ChatGPT, the scope of what we could theoretically access was huge, including GitHub, Slack and emails."
— Hacktron researchersAnd in a poetic twist, the researchers used rival AI giant Anthropic's Claude models to develop the exploit.
The Attack Chain: From HEIF File to Internal Repo
The attack chained two vulnerabilities together. Here's how it worked, step by step:
| Step | What Happened |
|---|---|
| 1. Entry point | OpenAI's community forum runs on Discourse, which typically uses FastImage for image checks |
| 2. The gap | FastImage didn't support HEIF files in the affected setup, so HEIF images passed through ImageMagick and libheif instead |
| 3. Exposure | This exposed the underlying libheif parser directly to attacker-controlled files |
| 4. Vulnerability found | Using Claude Opus 4.8, the team found a heap buffer overflow flaw in libheif |
| 5. First attempt | They tried to develop an RCE attack with Claude Opus 4.8, but it didn't work on Discourse's default configuration |
| 6. Second attempt | After Anthropic released Claude Opus 5, they used the newer model to generate a working exploit script |
| 7. RCE achieved | Remote code execution on OpenAI's instance |
| 8. Account takeover | Took over an OpenAI employee's account whose Codex was connected to OpenAI's GitHub organization |
| 9. Impact demonstrated | Sent a prompt to the employee's Codex to open a PR in OpenAI's internal monorepo — then stopped testing |
The critical insight: the initial flaw was in third-party software (libheif via ImageMagick), not OpenAI's own code. This is the modern supply chain risk in action.
Claude's Role: AI-Accelerated Exploit Development
What makes this story particularly significant is how the exploit was developed. The researchers didn't just use AI as a tool — they used it to accelerate the entire exploit development cycle:
- Claude Opus 4.8 — Used to find the heap buffer overflow in libheif
- Claude Opus 5 — Used to generate the working RCE exploit script after the first attempt failed
When the older model couldn't produce a working exploit for the default Discourse configuration, the researchers simply waited for Anthropic's next release — and it worked.
"Work that once required a well-resourced team and months of effort can now be compressed into days. Security assumptions must catch up with attacker capabilities."
— Hacktron researchersThis is the new reality of AI-powered offense. Attackers don't need deep expertise in every exploit class — they can use AI to find and weaponize vulnerabilities at machine speed.
Full Timeline of the Attack
Hacktron gained initial entry via OpenAI's community forum through the libheif vulnerability.
Used Claude Opus 4.8 to find the heap buffer overflow, then Claude Opus 5 to generate the working RCE exploit script.
Took over an OpenAI employee's ChatGPT/Codex account connected to OpenAI's GitHub organization.
Sent a prompt to the employee's Codex to open a PR in OpenAI's internal monorepo. Then stopped testing.
Reported the vulnerability to OpenAI.
OpenAI patched the issue, marked it resolved, and paid the Hacktron team a $6,500 bounty.
Discourse issued a fix adding image-processing sandboxing and published security advisory GHSA-vhm9-85gw-x335.
Total elapsed time: less than 72 hours from initial discovery to accessing OpenAI's repo.
Why This Matters for Every Business
It's tempting to read this story as an "AI company" problem. It's not. Every business that uses AI tools, cloud services, or third-party libraries faces the same class of risk.
Consider what this attack chain tells us:
- Third-party dependencies are the weak link — The entry point wasn't OpenAI's code; it was a library (libheif) used by a forum platform (Discourse)
- Connected services expand the blast radius — Because ChatGPT and Codex integrate with GitHub, Slack, and email, one account takeover can cascade across systems
- AI accelerates exploit development — What used to take months now takes days
- Zero-day to full compromise can happen in hours — Not weeks
- Human error is amplified — The chain required just one employee with elevated access and integrated tooling
If your business uses ChatGPT, Microsoft Copilot, or any AI assistant connected to your email, code repositories, or file storage — you have the same attack surface OpenAI had.
Why Businesses Rely on Managed IT Services for This
Here's the hard truth: most small and mid-sized businesses have no way to detect or defend against this class of attack on their own. The vulnerability was in a third-party library. The attack chain crossed multiple platforms. The exploit was developed by AI. And the total window was 72 hours.
That's where Managed IT Services (MSPs) come in. A modern MSP doesn't just "manage computers" — it provides the layered security controls and continuous monitoring required to keep pace with AI-accelerated threats.
What a Managed IT Services Partner Does for You
When an attack like this breaks, your MSP partner should already have controls in place. Here's what that looks like:
- Third-party risk management — Tracking vulnerabilities in libraries, plugins, and integrations across your stack
- Attack surface monitoring — Mapping every external service connected to your email, cloud, and code repositories
- Identity and access management (IAM) — Ensuring least-privilege access, MFA, and conditional access policies
- Email and cloud security — Detecting account takeover, suspicious logins, and anomalous API usage
- Endpoint detection and response (EDR) — Catching RCE attempts and unusual process activity
- Patch management — Rapidly deploying fixes for critical CVEs, including third-party dependencies
- Security awareness training — Reducing the human factor that AI-powered phishing exploits
- Incident response — Containing breaches within hours, not days
Why SMBs Choose Managed IT Over DIY
For most businesses under 500 employees, the "we'll handle it ourselves" approach breaks down quickly when AI is part of the threat equation:
- Skill gap — Identifying a heap buffer overflow in libheif is not a generalist skill. MSPs bring specialized expertise.
- 24/7 coverage — The attack window is measured in hours. If no one is watching at 2 AM, it's already too late.
- Cost — A single senior security engineer costs $150K–$200K per year. An MSP delivers a full team for a fraction.
- Tooling — MDR, EDR, SIEM, and cloud posture tools are expensive and complex. MSPs amortize them across clients.
- Accountability — A good MSP owns your security posture, not just the ticket queue.
If your business uses AI assistants connected to email, code repositories, or cloud storage — and you don't have dedicated security staff — a Managed IT Services partner is the most cost-effective way to stay protected.
What to Ask a Potential MSP Partner
If you're evaluating MSPs (or wondering whether your current one is doing enough), ask these questions:
- Do you track third-party library and supply chain vulnerabilities?
- How do you monitor for account takeover across cloud and AI services?
- Do you have MFA and conditional access enforced on all AI tools?
- Can you detect an RCE attempt in real time?
- What's your mean time to respond to a critical alert?
- How do you handle incidents that cross multiple platforms (email + AI + code repo)?
At SystemLogicIT, we provide Managed IT Services and Cyber Threat Protection tailored to businesses across the United States and United Kingdom. If your organization is adopting AI tools and wants a partner who understands this new class of risk, we'd be glad to talk.
What Businesses Should Do
Whether you manage IT in-house or through a partner, here's a practical checklist based on this attack:
- Audit your third-party dependencies — Know what libraries and services your platforms rely on
- Review AI tool integrations — What does your ChatGPT, Copilot, or other AI assistant have access to?
- Apply least-privilege access — Employees should not have more access than they need
- Enforce MFA everywhere — Especially on AI tools, email, and code repositories
- Monitor for anomalous logins — Account takeover often shows up as unusual geography or timing
- Track connected services — Every integration is a potential pivot point
- Patch rapidly — Both first-party and third-party software
- Train employees — Recognize phishing and social engineering attempts
- Prepare an incident response plan — Including AI tool compromise scenarios
- Engage a Managed IT Services partner — If keeping up with this pace isn't feasible in-house
If your organization needs help auditing AI tool access, monitoring cloud accounts, or building layered security controls, consider working with a Managed IT Services partner.
Final Thoughts
The Hacktron research is significant for three reasons.
First, it demonstrates the speed of AI-powered offense. A vulnerability that once would have required a well-resourced team and months of effort was exploited in days.
Second, it shows that AI companies are not immune. OpenAI has some of the best security talent in the world, and a third-party library in a help forum still opened a door.
Third, and most importantly, it highlights how connected services amplify risk. The attack didn't stop at an account takeover — it reached into GitHub through an integrated Codex account.
Every business that adopts AI tools is now part of this same attack surface. The question isn't whether AI is safe — it's whether your configuration of AI, integrated with your services, is defensible against AI-accelerated attackers.
Key takeaways:
- 72-hour attack — From initial discovery to OpenAI internal repo access
- Claude used as the tool — Opus 4.8 found the flaw; Opus 5 weaponized it
- Third-party library was the entry point — libheif via ImageMagick and Discourse
- Connected services expanded impact — ChatGPT and Codex linked to GitHub, Slack, email
- $6,500 bounty paid — OpenAI fixed within 14 hours of the report
- Discourse patched too — Added image-processing sandboxing (GHSA-vhm9-85gw-x335)
- Every business is exposed — If you use AI tools connected to other services, you have this attack surface
- Managed IT Services bridge the gap — Third-party risk, IAM, monitoring, and incident response
- Security assumptions must catch up — "Work that once required months now takes days"
If your organization needs help securing AI tool integrations, auditing connected services, or building layered defenses against agentic exploits, contact SystemLogicIT for expert Managed IT Services and Cyber Threat Protection across the United States and United Kingdom.