Hacktron AI is a security-research company that uses frontier AI models to find and exploit software vulnerabilities. Its team, led by Harsh Jaiswal (rootxharsh) alongside Mohan Pedhapati (s1r1us) and Rahul Maini (iamnoooob), became publicly known in September 2026 for an account-takeover intrusion against OpenAI developed with Anthropic's Claude models and disclosed through OpenAI's bug-bounty program. The company states that its mission is "to help secure the internet by finding and eliminating vulnerabilities in widely trusted software before malicious actors do," and that it is continuing this research "across frontier labs and other internet-critical systems" (Hacking OpenAI (Hacktron AI, September 2026)).
The OpenAI intrusion
On July 25, 2026 the team chained an unpatched heap buffer overflow in the libheif image decoder — version 1.19.7, shipped in the Debian 12-based Discourse Docker image behind OpenAI's community forum, community.openai.com — with a flaw in OpenAI's single sign-on, taking over multiple OpenAI employees' ChatGPT and Codex accounts and, through one employee's Codex, opening a proof-of-concept pull request in OpenAI's internal openai/openai monorepo. The team developed the exploit with Claude Opus 4.8 and Claude Opus 5 and reported the finding through OpenAI's Bug Bounty Program on Bugcrowd; OpenAI paid a $6,500 bounty on September 1, 2026 for the OpenAI-side single-sign-on finding, testing against the Discourse-hosted forum having been outside the program's scope. Hacktron published its own account on September 13, 2026, and the Wall Street Journal reported the intrusion on September 17 (Hacking OpenAI (Hacktron AI, September 2026)). The intrusion is documented in more detail at OpenAI and the models' roles at Anthropic, Claude Opus 5 and Claude Opus 4.8.
HEIF Heist
The OpenAI intrusion was one part of a research project the team calls HEIF Heist — a multi-month investigation tracing the libheif decoder across widely used software including Slack, Meta, GitHub Enterprise, Ruby on Rails, and Node.js frameworks such as Next.js, Astro and Gatsby. The company reports that the whole campaign, conducted by three researchers over about two months, cost less than $3,000 in tokens, that adapting the exploit to each new company usually took one or two days, and that it is aware of no target that detected the activity except Shopify, "even after thousands of images were sent and their image processors repeatedly crashed." The company frames the campaign as evidence that AI is eroding the practical barrier that once protected ordinary companies from known-but-hard-to-operationalize vulnerabilities, "turning more of this scarce expertise into compute" (Hacking OpenAI (Hacktron AI, September 2026)).
The team's members have also commented on frontier-model cyber capability outside the HEIF Heist context; Mohan Pedhapati is quoted assessing the offensive-security performance of open-weight models such as Kimi K3 against closed frontier models on the team's security benchmarks (Source: Raw Sources/On Kimi K3 (2026).md).
Relationships
- related: Hacking OpenAI (Hacktron AI, September 2026) — the company's disclosure write-up of the OpenAI intrusion.
- related: OpenAI — the target of the disclosed intrusion.
- related: Anthropic — developer of the Claude models the team used.
- related: Claude Opus 5, Claude Opus 4.8, GPT-5.6 (Sol, Terra, Luna) — the models the team used at successive stages of exploit development.
- related: AI and Cybersecurity, Autonomous cyber-agents, AI Coding Agents — the capability areas the company's work bears on.