Research
Hacking OpenAI
Publication date not yet evaluated · Added · 2 reports hacktron.ai
Page published
Coverage timeline
Why it matters
The Hacktron research demonstrates that frontier LLMs like Claude Opus 5 can be used to discover and weaponize memory-corruption flaws into working exploits fast enough to compromise a major AI vendor's own staff accounts and internal repos within 72 hours.
Hacktron researchers Harsh Jaiswal, Mohan Pedhapati and Rahul Maini used Anthropic's Claude Opus 4.8 and Opus 5 to find a heap buffer overflow in libheif (CVE-2026-32882) and generate a working RCE exploit against OpenAI's Discourse-based community forum, then chained it with an SSO identity flaw to take over OpenAI employees' ChatGPT/Codex accounts and reach an internal OpenAI repository via a proof-of-concept pull request. The authorized research was reported through OpenAI's Bugcrowd program, patched within ~14 hours, and earned a $6,500 bounty.