Claude Opus 5 Helped Indian Researchers Breach OpenAI in 72 Hours

A pull request — a proposed change to source code — opened inside OpenAI's private code repository on July 25. No OpenAI engineer wrote it. It was submitted through an employee's own Codex account by three security researchers who had never worked for the company — a polite, harmless way of proving they were standing inside one of the most closely watched AI labs on the planet.

The researchers — Harsh Jaiswal, Mohan Pedhapati, and Rahul Maini of San Francisco-based security startup Hacktron AI — published their full write-up this month, and The Wall Street Journal reported the story this week. The whole run, from their first look at OpenAI's community forum to that pull request, took under 72 hours. OpenAI fixed its side of the problem within about 14 hours of the report and paid the team a $6,500 bounty on September 1.

One image upload, two separate bugs

The way in had nothing to do with OpenAI's own code. The company's user forum, community.openai.com, runs on Discourse, an open-source forum software used by thousands of sites. When someone uploads an iPhone-style HEIC photo, Discourse passes it to a tool called ImageMagick, which decodes it through a library named libheif. That library carried a heap buffer overflow — a memory bug where software writes data past the space reserved for it, letting a crafted file run the attacker's code on the server.

Here's the uncomfortable part. libheif's developers had fixed that bug a year earlier, but the fix was never labelled a security patch and never received a CVE — the public tracking number assigned to known vulnerabilities. Because of that, Debian, the Linux distribution underneath Discourse's servers, never backported the fix. A patched bug stayed exploitable simply because nobody called it one. Discourse has since rated the issue 8.8 out of 10 in severity and shipped its own fixes.

The second bug belonged to OpenAI. Its forum offered "Sign in with OpenAI" — the same single sign-on, or SSO, that staff use elsewhere, where one login is reused across many services. The login tokens issued for the forum — the digital keys that prove a user is signed in — carried far more power than a forum needs. Once the researchers controlled the forum server, they could take over the ChatGPT and Codex accounts of anyone who had signed in, including OpenAI employees, without the victims doing anything at all. One employee's Codex account was connected to OpenAI's GitHub organisation. That's how the pull request happened.

Claude wrote the hard part

Finding a memory bug is one skill. Turning it into a reliable exploit against a live server is another — historically specialist work that eats weeks. The team first pointed Claude Opus 4.8 at the problem. It spotted the missing security fix and drafted a partial exploit, but kept failing against ASLR, a standard defence that shuffles where code sits in memory so attacks can't rely on fixed addresses.

Then, on the evening of July 24, Anthropic released Claude Opus 5. The researchers opened a fresh session with the same bug. Roughly three hours later, they had a working exploit. To stay inside the model's safety rules — Opus refuses to write exploits aimed at real remote servers — they pointed it at their own test forum disguised as a capture-the-flag target, the practice competitions hackers use to train, and let it run in an autonomous loop.

"We're just three guys with Claude and Codex subscriptions."

That's Pedhapati, Hacktron's chief technology officer, contrasting his tiny team with state-backed hacking groups in his comments to the Journal. The numbers back him up. In a wider two-month project the team calls HEIF Heist, the same class of image-decoding flaw was traced through software used by Slack, Meta, GitHub Enterprise, and several popular web frameworks — for under $3,000 in AI usage fees. According to the team, only one company, Shopify, noticed anything, even as thousands of test images crashed image processors.

The Indian trio behind the keyboard

All three researchers are Indian, and none took the elite-college route that India's tech industry usually celebrates:

• Harsh Jaiswal worked as a security engineer at Zomato and later at Vimeo; back in 2021, he and Maini won a $50,000 bounty from Apple after finding a way to execute code on its servers.
• Mohan Pedhapati, Hacktron's CTO, is a computer science graduate of RGUKT Nuzvid in Andhra Pradesh who came up through competitive hacking tournaments and German security firm Cure53.
• Rahul Maini holds a BTech from Bharati Vidyapeeth and has been Jaiswal's research partner since their early bug-hunting days.

The story lands differently in India for a second reason. Indian startups and IT firms are wiring AI coding agents into GitHub, Slack, and email in exactly the way OpenAI did — and India's own rules, through CERT-In, expect companies to report cyber incidents within six hours. That obligation assumes you can see a breach. Across Hacktron's entire campaign, almost nobody did.

Complexity is no longer a moat

For years, the software industry quietly relied on a comforting assumption: memory bugs were everywhere, but turning one into a working exploit took rare expertise, so most stayed theoretical. That assumption is now broken. The specific lesson here is about identity — a third-party forum became a path to employee accounts because one login token was trusted too widely. It rhymes with what attackers were caught doing this same week against WSO2's API management software, where forged admin tokens put systems tied to RBI's lending infrastructure at risk. Tokens and identities, not firewalls, are where the real perimeter sits now.

OpenAI, for its part, reportedly reassigned a quarter of its production engineers to security work after a separate breach earlier this year. The researchers' own conclusion is harder to shrug off: work that used to demand a well-funded team and months of effort now fits inside a few days. The same models that built this exploit chain are available to any defender willing to point them at their own systems. The uncomfortable question for every company reading this is which side of that equation they're on.