# What Was the HEIF Heist? Security Researchers Used Claude Opus 5 to Breach OpenAI in Under 72 Hours. > In September 2026, a three-person research team called Hacktron AI used Claude Opus 5 to exploit a vulnerability in OpenAI's community forum and gain access to employee ChatGPT and Codex accounts — and from there, OpenAI's internal GitHub. Here's what happened, what was accessed, and what it means for professionals who rely on these tools. **Author:** [Alex Lowe](https://theaicareerlab.com/about) — Founder, The AI Career Lab **Published:** 2026-09-18 **Canonical URL:** https://theaicareerlab.com/blog/heif-heist-claude-openai-hack-2026 **Category:** industry-news **Tags:** Claude, Anthropic, OpenAI, cybersecurity, AI safety, Claude Opus 5, security research, AI agents, industry news, 2026 ---> **TL;DR.** In September 2026, a three-person security team used Claude Opus 5 to exploit a vulnerability in OpenAI's community forum, take over employee accounts, and demonstrate access to OpenAI's internal GitHub — all in under 72 hours for under $3,000 in API credits. OpenAI patched the vulnerabilities within 14 hours and paid a $6,500 bug bounty. No user data was read; this was white-hat research. The story matters because it's the clearest public demonstration yet of how AI models can compress expert-level offensive security work into a fraction of the usual time and cost. --- A three-person security research team just published a detailed account of how they used Claude Opus 5 to break into OpenAI's internal systems in under 72 hours — and the method costs less than a month's software subscription. Here's what happened, what was actually accessed, and why professionals who use these tools should understand the mechanics. ## What is the HEIF Heist? Hacktron AI, a small security research firm, conducted what they called the "HEIF Heist" as part of a broader audit examining how HEIC/HEIF image processing vulnerabilities propagate across major software platforms. (HEIC is the image format iPhones use by default; HEIF is the container standard underneath it. When you photograph something on your iPhone, you're creating a HEIF file by default.) The attack vector was specific: OpenAI's community forum runs on Discourse, a popular open-source platform. When a user uploads a HEIC or HEIF image to the forum, Discourse calls ImageMagick — a widely-used image processing library — which in turn calls libheif to convert the iPhone-format image into a standard JPEG. Hacktron found a heap buffer overflow vulnerability in this libheif processing step. A heap buffer overflow is a class of memory vulnerability that lets an attacker write data outside the memory region the program allocated — and with careful construction, steer the program into executing attacker-controlled code. It's a sophisticated class of bug. Building a working exploit normally requires deep expertise in how the target system manages memory. ## Where Claude Opus 5 made the difference The Hacktron team first tried Claude Opus 4.8 to develop the exploit. It built a partial proof-of-concept, but couldn't produce a working exploit against a server with address-space layout randomization (ASLR) — a standard defense that randomizes where code lives in memory, making exploitation harder. This stalled the attack for weeks. After Anthropic released Claude Opus 5, the team gave it the same problem. Opus 5 produced a working ARM64 exploit within hours. It then adapted the exploit to x86-64 (Intel/AMD architecture) and jemalloc (the memory allocator Facebook originally developed, now used widely in production systems) without manual intervention from the researchers. The full chain — from the initial libheif vulnerability to server-level code execution — was complete within 72 hours. Total cost in API credits: under $3,000. For context, the same class of work by a specialist security consultant would typically take weeks and cost significantly more. ## The chain from a forum image to OpenAI's GitHub Getting code execution on the Discourse server was step one. Step two was a second, separate flaw: an OpenAI single sign-on (SSO) configuration issue that let the researchers convert their forum server access into authenticated sessions for OpenAI employee accounts. Once inside an employee's account, the researchers found that the employee's Codex — OpenAI's AI coding agent — was connected to OpenAI's GitHub organization. They followed that connection and demonstrated access by creating a harmless pull request in an internal repository. The access chain: HEIF image upload → forum server code execution → SSO flaw → employee ChatGPT/Codex account → connected GitHub organization. Both VentureBeat and The Decoder have confirmed the attack chain with Hacktron's published technical details and OpenAI's response. ## What was actually accessed — and what wasn't The Hacktron team conducted this as responsible disclosure — they notified OpenAI before publishing and held the report while OpenAI patched. The researchers say they accessed only what was needed to demonstrate the breach: they verified the employee account takeover, then created the benign pull request in GitHub as a proof-of-concept. They did not read source code, training data, or sensitive internal documentation. According to the VentureBeat report, Hacktron was explicit: "We didn't view any sensitive data." OpenAI confirmed the breach and the scope. They narrowed the permissions on Community sign-in tokens, revoked affected tokens and sessions, and patched both vulnerabilities. Time to patch: 14 hours. Bug bounty paid via Bugcrowd: $6,500. ## What the same vulnerability exposed elsewhere HEIF image processing is used by more than Discourse. As part of the broader HEIF Heist research, Hacktron also found the same class of vulnerability in Slack, Zoom, Meta's photo processing stack, and GitHub Enterprise — anywhere that libheif or similar libraries process user-uploaded HEIF/HEIC images. The team's full disclosure report lists each vendor's response. Most patched within weeks. This matters for professionals because many of these platforms are deeply embedded in workplace workflows — a Slack or GitHub Enterprise version of the same attack path would have different entry points but comparable consequences. ## What this means for professionals Two things are worth taking away from the HEIF Heist. **The first is about AI and the security threat landscape.** The specific vulnerability in this attack — libheif — is a known class of memory-safety bug. What's new is that Claude Opus 5 eliminated the expertise bottleneck: writing a working exploit for this kind of memory vulnerability in a real production environment used to be the hard part. Hacktron's published details confirm that Opus 4.8 couldn't do it and Opus 5 could. That's not a theoretical shift — it's a documented, reproducible one, with a price tag under $3,000. The AI security community has been warning about this for two years: AI reduces the human expertise required for complex attacks. The HEIF Heist is the clearest public demonstration yet of what that means in practice. **The second is about SSO chain hygiene.** The forum server access wouldn't have reached GitHub without the SSO connection to employee accounts, and the employee account wouldn't have reached GitHub without Codex being connected to the GitHub organization. Each connection in the chain multiplied the blast radius. This dynamic applies to every professional using AI tools: if your Claude or ChatGPT account is connected to other services — email, calendar, file storage, code repositories — a breach of the AI platform surface carries all of those connections with it. Auditing and trimming connected apps is a concrete step that reduces what's reachable through any single entry point. The specific vulnerabilities in the HEIF Heist are patched. But the method is public, and the cost curve for this class of attack is now well-established. --- ## Sources - [OpenAI Hacked by Small Team Using Anthropic's Claude Opus 5 — VentureBeat](https://venturebeat.com/security/openai-hacked-by-small-team-of-white-hat-security-researchers-using-anthropics-claude-opus-5) - [Security Researchers Used Anthropic's Claude to Hack OpenAI's Internal Systems in Under 72 Hours — The Decoder](https://the-decoder.com/security-researchers-used-anthropics-claude-to-hack-openais-internal-systems-in-under-72-hours/) - [Researchers Used Anthropic's Claude to Hack into OpenAI — TechCrunch](https://techcrunch.com/2026/09/18/researchers-used-anthropics-claude-to-hack-into-openai/) - [Security Researchers Hacked Into OpenAI Using Anthropic's Claude — Forbes](https://www.forbes.com/sites/siladityaray/2026/09/18/security-researchers-hacked-into-openai-using-anthropics-claude/) ## Frequently asked questions ### What is the HEIF Heist? The HEIF Heist is the name a security research team called Hacktron AI gave to a proof-of-concept attack they conducted against OpenAI in mid-2026. In under 72 hours, the three-person team used Claude Opus 5 to develop a working exploit for a vulnerability in how OpenAI's community forum processed uploaded images, then chained a second flaw to convert that server access into access to employee ChatGPT and Codex accounts. From an employee's Codex account, they demonstrated access to OpenAI's internal GitHub organization by creating a harmless pull request. The name refers to the HEIC/HEIF image format — the format iPhones default to — that triggered the initial vulnerability. ### How did Claude Opus 5 help the attackers? The underlying vulnerability was a heap buffer overflow in libheif, an open-source library that Discourse (the forum software) uses to convert HEIC/HEIF images into standard JPEGs when users upload them. Writing a working exploit for this kind of memory vulnerability — one that works against a real, hardened server — normally requires advanced expertise in memory corruption techniques. The Hacktron team tried Claude Opus 4.8 first; it built a partial exploit but couldn't get past address-space layout randomization (ASLR). After Claude Opus 5 was released, the team gave it the same problem: it produced a working ARM64 exploit within hours, then adapted it to x86-64 and jemalloc memory environments. The full exploitation path was complete in under 72 hours. Total cost: under $3,000 in API token credits. ### What data was actually accessed? The researchers say they accessed only what was necessary to demonstrate the breach. Specifically, they took over employee ChatGPT and Codex accounts via an OpenAI single-sign-on flaw, then used an employee's connected Codex account to open a benign pull request in OpenAI's internal GitHub repository as proof of access. The Hacktron team stated they did not read sensitive data, review source code, or access training infrastructure. This was responsible disclosure — the team notified OpenAI before publishing and gave them time to patch. ### Was my ChatGPT account compromised? No. The attack targeted OpenAI employee accounts via a specific chain: forum server compromise → SSO flaw → employee account takeover. Regular user accounts were not part of the demonstrated attack path. OpenAI confirmed this and patched both vulnerabilities within 14 hours of notification. If you had no connection to the forum's employee SSO infrastructure, your account was not in the exploit's blast radius. ### How did a forum image upload turn into access to OpenAI's GitHub? The attack used a technique called vulnerability chaining — linking two separate flaws to achieve an impact neither could achieve alone. Step one: the libheif heap buffer overflow in Discourse let the researchers execute code on OpenAI's forum server. Step two: a separate OpenAI SSO configuration issue let them convert that server access into authenticated sessions for employee accounts on OpenAI's platform. Step three: one of those employee accounts had Codex connected to OpenAI's GitHub organization. The researchers followed that connection from the account's settings, landing them inside a private repository. The HEIC image upload was merely the entry point — it's the SSO chain that turned a forum bug into GitHub access. ### What should professionals do about this? The specific vulnerabilities are patched. The broader lesson: SSO connections between services are what turned a low-severity forum bug into a high-severity breach. Check which apps are connected to your ChatGPT account (Settings → Connected Apps), your Claude account (claude.ai Settings → Integrations), and any other AI tools you use. Remove anything you no longer actively need. Enable two-factor authentication on every AI platform account you use. These hygiene steps don't stop a motivated attacker with zero-days, but they reduce what's reachable if any single entry point in the chain is compromised. --- *Canonical version: https://theaicareerlab.com/blog/heif-heist-claude-openai-hack-2026* *This document is the Markdown companion served for AI crawlers and answer engines. See the canonical URL for the rendered version with navigation, related content, and interactive elements.*