White-hat hackers breach OpenAI internal codebase using Claude-assisted exploit

A three-person team from Hacktron successfully breached OpenAI's internal codebase within 72 hours by chaining a heap buffer overflow in libheif with an SSO misconfiguration. Using Claude Opus 5 to generate the exploit, the team gained access to an employee account and submitted a harmless pull request to prove the vulnerability. OpenAI awarded the team a $6,500 bounty, noting that the forum used for the initial entry was outside their official bug bounty scope. The researchers highlighted that AI tools significantly accelerated their ability to identify and exploit vulnerabilities across various major platforms.