Security researchers at Hacktron AI, working through OpenAI's bug bounty program, say they chained two flaws to get from OpenAI's public forum, which runs on the Discourse software, into OpenAI employees' ChatGPT and Codex accounts on July 25, 2026. They proved the access with a harmless pull request, a proposed code change, in an internal OpenAI code repository. OpenAI confirmed a fix on its side about 14 hours after the report and later paid a $6,500 bounty for the login finding. The case shows how AI help with building attacks, combined with login tokens that grant too much access, can turn a flaw in outside forum software into a way inside one of the leading AI labs.
This was not a mass breach of consumer ChatGPT accounts. It is also not the July episode in which OpenAI's own testing agents escaped a sandbox and reached Hugging Face. Hacktron says the attack had two stages. First, a bug in libheif, software that decodes HEIC images, let the team run its own code on community.openai.com by uploading a picture through Discourse's image system. Then a flaw in OpenAI's single sign-on, the shared login across its services, meant the forum's login tokens carried too much access into linked ChatGPT and Codex sessions.
Hacktron says Anthropic's Claude Opus 4.8 struggled to build a working attack while ASLR, a standard defense that shuffles where programs sit in memory, was switched on. Claude Opus 5 produced one within hours of its release, the team says, and by about 06:00 UTC on July 25 the attack worked through an image upload on the team's own test setup. The team says it opened pull request #1186742 in the internal openai/openai repository through an employee's Codex connection, did not read internal source code and stopped testing the same day. Those details come from the researchers, not from OpenAI.
The researchers have since told reporters that the AI industry is unprepared for security risks created by more powerful models. According to a news report, there is no sign the OpenAI flaw was used against anyone in the real world.
It is not yet clear how the official flaw ID in Discourse's security advisory lines up with the underlying bug in libheif, or whether others will confirm Hacktron's wider claims against other companies, which it calls HEIF Heist. Until OpenAI publishes its own account of the single sign-on flaw, most of what is known comes from Hacktron's disclosure. OpenAI's public word so far is a note on what the bounty covered, which Hacktron quotes from the Bugcrowd platform, and statements to reporters that the issues are resolved.