Skip to content
PERMISSION/PROTOCOL
Back to incident tracker

2026-07-25

HighPrimary

Claude-Assisted Exploit Chain Let Researchers Compromise an OpenAI Employee Account and Reach the Internal GitHub Monorepo

Analysis of Hacktron's controlled research chain from Claude-assisted libheif exploitation and OpenAI SSO account takeover to a Codex-created internal pull request.

Claude Code and OpenAI CodexCredential exposureControlled AI-assisted vulnerability research, account takeover, and connected-service accessOpenAI's community forum, OpenAI SSO, employee ChatGPT and Codex account, and connected private GitHub organization

What happened

Claude sessions found and developed the image-decoder exploit, an autonomous Claude goal loop achieved remote code execution in a controlled Discourse environment, and the researchers later instructed a compromised employee Codex account to open pull request 1186742 in OpenAI's internal monorepo.

Why it matters

Production compromise of OpenAI's community forum and an employee ChatGPT and Codex account, with demonstrated connected GitHub write access. The researchers say they did not inspect internal source code and stopped after creating the proof pull request.

Missing authorization check

Separately authenticated, action-bound approval before a compromised AI account can use inherited GitHub or other connector credentials to mutate private systems.

Would PP block it?

The researchers could still compromise the forum and AI account and may retain access to ungated data. If GitHub writes, deployments, publication, email sends, or other connector mutations require a receipt bound to the exact action and independently authenticated signer, the inherited session cannot authorize those actions by itself.

Incident analysis

Timeline and technical read

Timeline

  1. 2026-07-23

    Hacktron begins reviewing Discourse's image-upload path and uses Claude Opus 4.8 to investigate the installed libheif package.

  2. 2026-07-24

    The researchers use Claude sessions to develop and adapt a working libheif code-execution exploit.

  3. 2026-07-25

    Hacktron reports achieving RCE on OpenAI's forum, chaining it with the OpenAI SSO weakness, taking over an employee AI account, and proving connected GitHub access with a harmless internal pull request.

  4. 2026-07-28

    Discourse publishes GHSA-vhm9-85gw-x335 with patch and rebuild guidance after preparing a fix and adding image-processing sandboxing.

  5. 2026-09-13

    Hacktron publishes its coordinated technical disclosure.

Technical breakdown

  • Claude Opus 4.8 identified missing security backports in the libheif package used by Discourse and helped produce an exploit with address-space randomization disabled.
  • After Opus 5 was released, new sessions adapted the exploit to the relevant architecture and allocator; an autonomous goal loop against Hacktron's own Discourse Cloud environment achieved remote code execution.
  • The researchers used the generated exploit against community.openai.com and combined forum access with a separate OpenAI SSO weakness to take over ChatGPT and Codex accounts.
  • The compromised employee Codex account was connected to OpenAI's GitHub organization, and Codex opened a harmless internal pull request as the proof of impact.

Authorization boundary

Where the authorization boundary should have been

This incident is categorized as Credential exposure. The relevant Permission Protocol gate is Credential Gate. The read is conditional: the block only applies where the real action boundary is routed through a gate.

If enforced at
Connected-system mutation boundaries outside the compromised ChatGPT or Codex account
Still needs
Image-decoder vulnerability remediation, forum RCE, SSO security, account takeover prevention, read-only data access, and connectors that do not enforce receipts
Receipt required for
Creating or merging pull requests, deploying code, sending external communications, or mutating connected enterprise systems through an AI account

Permission Protocol cannot prevent the image-decoder RCE, repair SSO, or stop account takeover, but a Credential Gate can require authority outside the compromised AI session before connected systems accept consequential mutations.

Start small

Put the relevant gate at this action boundary.

This incident maps to Credential Gate. Start with the boundary that controls the actual action, then require a signed receipt before execution.

Replay this incident with a signer in the loop