A harmless pull request inside OpenAI’s private code repository is not usually the kind of thing that makes headlines. But PR #1186742 is different. It was created by an AI agent, using a compromised employee account, by a three-person research team working out of the UAE and India, who had started the whole exercise by uploading a photo to a public forum. They did it in under 72 hours.
According to GCC Startup News, the researchers, Harsh Jaiswal, Mohan Pedhapati, and Rahul Maini of cybersecurity firm Hacktron AI, discovered and chained two separate vulnerabilities to demonstrate access to active OpenAI employee accounts on ChatGPT and Codex, and from there, into an internal OpenAI software repository. OpenAI fixed the issues and paid them a $6,500 bug bounty. That number feels low given what the team found.
The entry point was OpenAI’s public community forum, which runs on the Discourse platform. The researchers began looking at how the forum handled HEIC and HEIF image files, a format most people associate with iPhone photos. That investigation led them to a vulnerable image-processing library called libheif. With enough work, they turned that library flaw into remote code execution on the server. From there, they identified a weakness in OpenAI’s single sign-on authentication system. Chain the two together, and the path from a public forum to internal employee accounts becomes uncomfortably short.
But the part of this story that deserves the most scrutiny is the role Anthropic’s Claude played. The team used Claude throughout the research, from analyzing the vulnerability to writing and adapting exploit code. When Claude Opus 4.8 failed to produce a reliable exploit against local security protections, the researchers waited for Claude Opus 5 and tried again. This time, the model produced a working exploit within hours. The researchers then worked with it to adapt that code to OpenAI’s specific environment.
Let’s be clear about what this means. Claude did not independently decide to attack a competitor’s systems. Human experts drove every decision. They chose the target, interpreted the results, and set the limits on what actions to take. The pull request was harmless by design. They stopped when the point was made. But Claude compressed what might have been weeks of work into hours, and that is the real privacy and security implication here for anyone running a platform that accepts user uploads.
The broader warning in this research goes well beyond OpenAI. The libheif vulnerability affects a wide range of applications that accept HEIC or HEIF image uploads. Any organisation that has not audited exactly how it processes those file types is exposed to the same class of risk. The researchers said their full HEIF Heist project covered two months of work across three people and cost less than $3,000 in AI usage fees. That is an extraordinarily low barrier for the kind of access they demonstrated.
For privacy and security teams, the uncomfortable takeaway is this: the same AI tools that help defenders find vulnerabilities faster are available to everyone else too. The OpenAI incident shows what skilled researchers can do with modest resources and access to current AI models. Companies that assume their internal systems are insulated from public-facing attack surfaces need to look again. An image upload field and a misconfigured library can be closer to your employee accounts than you think.