3 researchers hacked OpenAI in 72 hours for under $3,000 using Claude Opus
FinanceYF5 · x · 2026-09-21
Three Indian security researchers (Harsh Jaiswal, Mohan Pedhapati, Rahul Maini) used Claude Opus to chain two critical vulnerabilities and take over OpenAI employees' ChatGPT/Codex accounts in under 72 hours.
- A heap buffer overflow in libheif, reached via ImageMagick and Discourse image uploads on community.openai.com
- An SSO identity misconfiguration that let any forum user log in as an OpenAI employee
- With account access, they could reach connected GitHub, Slack and email, and proved access by opening a PR in OpenAI's internal monorepo without reading sensitive data
They reported it immediately, coordinated patches with OpenAI and Discourse, and received a $6,500 bounty. None of the three had elite-school or big-tech backgrounds.
More from AGI Musings
- Why Is Inkling 2 Small Trained on So Few Tokens Yet Still Competitive? — georgejrjrjr · 2026-11-12
- Researcher willing to bet $100K the intelligence explosion won't happen next year — NathanpmYoung · 2026-11-12
- ICLR reviewer: the worst parts of my job are reading and answering AI slop — chhaviyadav_ · 2026-11-12
- Agent Swarms Are Autonomously Hacking Critical Infrastructure Run by Underpaid Devs — menhguin · 2026-11-12
- Fermi paradox twist: advanced civilizations may go digital after developing AI — VraserX · 2026-11-12
- Mark Cuban: AI could make healthcare costs 'drop like a rock' — alvelda · 2026-11-12