OpenAI says it fixed a security flaw that researchers said could turn a compromise of its public community forum into access to employee-linked ChatGPT and Codex accounts. The company narrowed permissions on the relevant Community sign-in tokens, revoked affected tokens and sessions, and paid the researchers $6,500, according to an OpenAI spokesperson quoted in an AFP report carried by The Straits Times.
Hacktron AI says it chained a vulnerability in OpenAI’s Discourse-based forum with an issue involving OpenAI single sign-on for that service. The researchers said they stopped after creating a harmless proof-of-concept pull request through an employee’s Codex-connected account. OpenAI’s comments cited by AFP did not detail the claimed account-access path or repository proof of concept.
A forum flaw became an identity-boundary problem
In its technical write-up, published September 13, Hacktron identifies the researchers as Harsh Jaiswal, Mohan Pedhapati and Rahul Maini. Their account says the first component involved image processing in the Discourse software used by community.openai.com. They traced the issue to libheif, a library used to process image formats, in the forum’s containerized environment.
Hacktron says it obtained remote code execution on the forum on July 25. It says permissions attached to Community sign-in tokens then allowed the forum compromise to be used to take over employee ChatGPT accounts and reach Codex connections. The team describes creating a proof-of-concept pull request in an internal OpenAI repository while avoiding sensitive code.
Hacktron’s report is the detailed public account of the test’s scope, including its assertion that multiple employee accounts were affected and that an internal pull request was created. The available reporting does not establish that source code was read, copied or exfiltrated, or that there was a continuing compromise.
OpenAI’s reported response focused on the token permissions and affected sessions. Those changes address the link Hacktron described between the compromised forum and employee-linked services.
What Claude did — and did not — demonstrate
The disclosure also drew attention because Hacktron says it used Anthropic’s Claude models during the research. Its account says Claude Opus 4.8 helped identify the libheif-related issue but did not produce a reliable exploit for the target configuration. After Claude Opus 5 became available, Hacktron says it produced a workable adaptation within hours under human direction.
Hacktron’s account describes AI assistance in its vulnerability-research workflow, not an independently measured instance of autonomous hacking. The researchers selected the target, assessed outputs, carried out the test and decided to disclose the findings. Its reported time savings are not an independent benchmark comparing work with and without an AI model.
The researchers’ experience suggests that a language model can help speed work across software packages, deployment details and exploit hypotheses when guided and tested by specialists. This case does not establish that model output is reliable without such testing.
Disclosure and remediation
Hacktron says it began examining the forum image-upload path on July 23, continued exploit work on July 24, and made its demonstration and report to OpenAI on July 25. It says the Discourse component was separately reported through HackerOne, while the OpenAI findings went through Bugcrowd. The company says it stopped testing after making the proof-of-concept pull request.
AFP reported September 18 that OpenAI spokesperson Drew Pusateri said the company fixed the flaw within about 14 hours and paid a $6,500 bounty. OpenAI’s public Bug Bounty Program, administered through Bugcrowd, lists rewards from $200 to $20,000 depending on severity and impact, although its program page does not document this report.
OpenAI’s attributed comments confirm the reported remediation rather than every technical detail in Hacktron’s account: the company narrowed Community sign-in-token permissions and revoked affected tokens and sessions.
