Researchers used Claude Opus 5 to breach OpenAI's monorepo

A heap buffer overflow in libheif reached a pull request inside OpenAI's private monorepo in under 72 hours, according to Hacktron's writeup published September 18. The bug traces back to a missing Debian 12 and 13 security backport. That gap put an AI coding agent three hops from a company's source code.

ImageMagick's HEIF handling carried the overflow into Discourse image uploads on community.openai.com, giving Hacktron's researchers remote code execution and Discourse admin access between 05:00 and 06:00 UTC on July 25. That foothold exposed an OpenAI SSO misconfiguration. By 15:30 the same day, the researchers held employee ChatGPT and Codex accounts along with their connected GitHub integrations. From there, an AI assistant opened a proof-of-concept pull request in OpenAI's internal monorepo. OpenAI confirmed a fix by 22:49 that night.

The payout was $6,500, awarded for the SSO finding rather than the Discourse compromise that started the chain.

Hacktron also says Claude Opus 4.8 failed the ARM64 exploit across several sessions before Opus 5 produced a working one in hours, per the WSJ.

The writeup doesn't say how long the unpatched libheif version sat in front of Discourse before Hacktron found it, or whether other OpenAI-adjacent services shared the same dependency.