Security researchers at Hacktron AI used Anthropic's Claude Opus 5 to exploit vulnerabilities in OpenAI's systems, gaining access to employee ChatGPT accounts through a flaw in Discourse's image upload handling. OpenAI awarded the team a $6,500 bug bounty after the vulnerabilities were reported and subsequently patched.
On July 25, 2026, security researchers chained a heap buffer overflow in libheif with an OpenAI SSO misconfiguration to compromise employee ChatGPT accounts and access internal OpenAI repositories. The attack exploited image upload functionality on OpenAI's community forum and was reported responsibly, resulting in a $6,500 bounty.
Hacktron disclosed a chain of two critical vulnerabilities discovered on July 25, 2026 that could compromise OpenAI employees' ChatGPT accounts: a heap buffer overflow in libheif and an SSO misconfiguration on community.openai.com. The researchers demonstrated access by opening a pull request in OpenAI's internal repository and received a $6,500 bounty after coordinated disclosure.