A newer AI model succeeded where an older one had failed for days, and that gap was enough to take a security research team from a public help forum into an OpenAI employee’s internal source repository. The finding, disclosed by the research firm Hacktron on September 18, is less a story about one company’s forum software than about how fast a model upgrade can turn a stalled attack into a working one.
A Forum Bug and a Login Flaw, Chained
Hacktron researchers Harsh Jaiswal, Mohan Pedhapati and Rahul Maini began probing the Discourse-based help forum at community.openai.com in late July. They found a memory-corruption flaw in the image-decoding library the forum used to process uploaded pictures, the kind of bug that, if triggered correctly, lets an attacker run code on the server handling the upload. Separately, they identified a weakness in how OpenAI’s “Sign in with OpenAI” flow trusted sessions originating from the forum, a boundary that let a compromised forum account escalate into a live ChatGPT and Codex session belonging to an OpenAI employee.
Neither bug alone was unusual. Image-parsing libraries have a long history of memory-safety flaws, and SSO trust boundaries are a recurring weak point across the industry. What made the chain notable was the second half of the work: turning the memory-corruption bug into a reliable, working exploit against a modern, hardened Linux server.
Media Partner
Where Opus 4.8 Stalled and Opus 5 Did Not
According to Hacktron’s account, the team spent multiple sessions trying to get Claude Opus 4.8 to produce a working exploit for the ARM64 target, without success. Anthropic released Claude Opus 5 on the evening of July 24. Within about three hours, the newer model produced a working exploit. Run autonomously against the forum’s cloud-hosted environment the next morning, it achieved code execution by 10:00 AM UTC on July 25. From there, the team moved from server access to a compromised employee’s ChatGPT and Codex session, then to a connected GitHub account, in the space of a single day.
To demonstrate impact without touching anything sensitive, the researchers had the compromised Codex account open a single, harmless pull request in an internal OpenAI repository, evidence that the chain reached a real, private codebase, then stopped. They did not read source code beyond what the pull request required, did not merge or ship anything, and did not touch customer data. OpenAI confirmed a fix roughly 14 hours after the report and paid a $6,500 bounty on September 1.
OpenAI, addressing the scope of that award, said in a statement quoted on Hacktron’s disclosure: “Testing against the Discourse-hosted community.openai.com was explicitly excluded from our bug bounty program. The award recognizes the OpenAI-side finding.” The distinction matters for other organizations running similar bug bounty carve-outs around third-party-hosted forums and support tools: a component outside the formal scope can still be the entry point into everything inside it.
The Part That Should Worry Every Defender
Because the compromised accounts belonged to OpenAI staff, and staff routinely connect ChatGPT and Codex to other services, Hacktron said the same access could in theory have reached tools such as GitHub, Slack and corporate email, well beyond the single proof-of-concept pull request the team actually touched. That is the structural risk of an AI coding assistant with broad connector access: compromising the account is not the end of the blast radius, it is the start of it, because the assistant itself is a pre-authenticated bridge into every service a user has linked to it.
This is not the first time CyberTech has covered that structural risk. A prior worm variant abused AI coding-agent credentials directly to spread through connected repositories, and a separate disclosure this year showed a plugin-verification bypass shared across nearly every major AI coding agent. What changed with the Hacktron finding is the demonstrated speed of the offensive side: an exploit that had resisted one model version for days became reliable within hours of the next version’s release, a pattern CyberTech has also tracked in the broader exploit-development race between frontier AI labs.
What It Means for the Security Leader
The lesson is not that Claude, or any specific model, is uniquely dangerous. It is that the capability gap between “this model cannot weaponize this bug class” and “this model can” is now measured in a single release cycle, not the months or years defenders have historically had to prepare for a new class of automated attack tooling. Security teams that treat AI-assisted exploit development as a future problem are working from a timeline that no longer holds.
Three things follow directly from this disclosure. First, any support forum, help desk or community platform connected, even loosely, to an internal identity system is part of the attack surface for that identity system, not a separate, lower-stakes property; scope bug bounty programs and monitoring accordingly. Second, memory-unsafe image and file-parsing libraries remain a durable source of remote code execution and deserve the same patching urgency as any internet-facing service, regardless of how minor the feature seems. Third, and most specific to 2026, any AI coding assistant with connector access to source control, chat or email should be treated as a privileged identity in its own right, with session-level monitoring and connector-scoping, because a single compromised employee session can now reach as far as the assistant’s connectors allow.
What to Do Now
Audit which internal identity flows trust sessions originating from third-party-hosted forum or help-desk software, and close any implicit trust that was never explicitly scoped. Confirm image and file upload pipelines are running current, patched decoding libraries, and that upload processing is sandboxed away from systems holding session tokens. Inventory which connectors (source control, chat, email, ticketing) are linked to AI coding assistants used by staff, and apply the same access reviews and anomaly monitoring already required for any other privileged non-human identity.
Source: Hacktron
