Claude Opus 5 Helped Researchers Breach OpenAI Staff Accounts Through Chained Security Flaws

Security researchers at Hacktron used Anthropic's Claude Opus 5 to chain two vulnerabilities and take over ChatGPT and Codex accounts belonging to OpenAI employees in under 72 hours — then reached an internal OpenAI code repository.

The breach was controlled security research rather than a malicious attack. The Hacktron team reported the flaws to OpenAI immediately after proving access with a harmless pull request. OpenAI confirmed a fix within 14 hours and paid a $6,500 bounty on September 1 — but the implications for AI-assisted hacking and single sign-on security extend far beyond one company's patched forum.

How a Public Forum Became a Gateway to OpenAI's Internals

The attack chain began with a bug in Discourse — the open-source software running OpenAI's public help forum. Discourse passes uploaded HEIC and HEIF images to a tool called ImageMagick, which relies on the libheif library to process them. A flaw in libheif tracked as CVE-2026-32882 allowed a specially crafted image to corrupt the forum server's memory.

LibHeif's own advisory describes CVE-2026-32882 as an out-of-bounds read capable of crashing software or leaking nearby memory. That leaked memory helped defeat address space layout randomization (ASLR) — a common defense designed to make it harder for attackers to predict where code sits in memory. Discourse's advisory rates the combined result as remote code execution with a severity score of 8.8 out of 10.

The fix had already existed for months. LibHeif 1.22.0 patched the flaw in May 2026 and the CVE was public. But the forum's server still shipped the unpatched version — libheif 1.19.7 — because Debian 12 had not yet included the updated library in its packaged build when researchers examined the server in July. This is a recurring problem across enterprise environments: public disclosures and available patches do not automatically translate into updated production systems, particularly where dependency chains run through operating system package managers on slower release cycles.

Once the researchers achieved code execution on the forum server, a second vulnerability compounded the damage. OpenAI's forum offered a "Sign in with OpenAI" option — the same single sign-on (SSO) system that staff used across other internal tools. Control of the forum server meant control of that identity layer. The victims did not click anything or make a mistake. Their accounts were simply reachable through the shared login.

"This was an OpenAI identity problem not a flaw in the forum software," Hacktron stated — noting that any first- or third-party service using the same sign-on could have granted equivalent access.

This is precisely the risk that makes identity and access management best practices for enterprise security so critical. When a shared identity layer connects a low-trust public surface to high-trust internal systems, a single point of compromise can cascade silently across an entire organisation.

Why the Vulnerability Persisted

The gap between a patch being available and that patch reaching production is not unique to OpenAI's forum configuration. Organisations running software on major Linux distributions frequently depend on downstream package maintainers to incorporate upstream fixes — a process that can lag by weeks or months. In this case, the libheif update had been available since May 2026. The server remained exposed in July because the distribution's packaging cycle had not caught up. That lag, multiplied across thousands of self-hosted deployments, represents a structural risk that individual patch announcements rarely resolve.

---

The Role Claude Opus 5 Played in Building a Working Exploit

This is where the story intersects with a wider industry concern about AI and offensive security.

Hacktron describes itself as an AI-assisted security research firm and leaned heavily on large language models throughout the project. The team first attempted the exploit using Claude Opus 4.8. That model struggled across multiple sessions to produce working code once ASLR was enabled.

Anthropic released Claude Opus 5 on the evening of July 24. In a fresh session, the newer model produced a working exploit within hours — a result that would have taken significantly longer using traditional methods. The researchers noted that Opus 5 ships with safeguards designed to prevent it from writing exploit code for real targets. They bypassed those guardrails by framing their own test server as a capture-the-flag practice environment and running the model in an automated loop.

Even so, Hacktron was clear that skilled human direction remained essential throughout. "This was not automated hacking with no one at the controls," the team said.

The Compression of Offensive Capability

The case fits a pattern that both researchers and AI companies have flagged repeatedly in 2026. Anthropic has reported that criminal and state-backed groups are already using Claude models to assist with real intrusions — not simply to answer questions. Capable AI models are compressing the time and technical skill that serious offensive work once demanded.

The gap between what a skilled attacker could accomplish in a week and what an AI-assisted attacker can accomplish in hours is narrowing at a rate that outpaces most organisations' defensive planning cycles. Understanding how artificial intelligence is reshaping cybersecurity threats and defences is no longer optional for security teams — it is foundational to assessing exposure accurately.

The Hacktron case also highlights a specific risk with automated AI pipelines in offensive contexts. When a model is placed in a loop without human review at each step, guardrail bypasses that might be caught in an interactive session can propagate undetected. That dynamic applies as much to defenders building AI-assisted monitoring tools as it does to attackers — automated does not mean supervised.

---

What Organisations Should Do Now

The Hacktron team stopped well short of what the access could have enabled. When one employee's Codex link to OpenAI's GitHub repository was opened, it triggered a single pull request in the internal repo. The team did not read source code, merge anything, or touch customer data. Because staff connects additional services to ChatGPT and Codex, however, the researchers said the same foothold could theoretically have extended to GitHub, Slack, and email.

OpenAI confirmed there is no sign the flaw was exploited by any outside party. As of mid-September 2026, the vulnerability did not appear on the U.S. government's list of known-exploited vulnerabilities.

The Discourse project has already patched self-hosted installations — fixed releases are 2026.7.0, 2026.6.1, 2026.5.2, and 2026.1.6. Sites hosted directly by Discourse were already updated. Organisations running their own Discourse servers should rebuild on the latest image because a web-interface update alone may not replace the old libheif library.

Technical Remediation Steps

• Update libheif to version 1.23.4 or your distribution's current patched build
• Disable decoding of untrusted HEIF and AVIF images where that capability is not needed, or isolate image processing inside a sandboxed environment
• Audit which services share your single sign-on and require a fresh identity verification before granting access to sensitive internal tools

The Broader Structural Lesson

The OpenAI incident is a reminder that a public-facing service carrying low-trust user content can become a direct path to high-trust internal systems when a shared identity layer connects them. That risk does not disappear once a specific CVE is patched — it persists wherever a shared authentication mechanism exists across services with asymmetric trust levels.

Organisations operating AI-integrated infrastructure face an additional layer of exposure. The risks and challenges of deploying artificial intelligence in business environments include not only the tools organisations build themselves but the attack surface that AI-assisted adversaries can now reach faster and with less specialised knowledge than before.

Organisations that have already patched should consider reviewing access logs from before the fix. The available sources do not address whether earlier compromise is possible, and that question remains open. For security teams conducting that review, the absence of an entry on the known-exploited vulnerabilities list is not confirmation of safety — it reflects reporting lag as much as it reflects actual exposure history.

The compressed timeline of this breach — from a public CVE to a working exploit on a real target in hours, with AI assistance — should inform how organisations model attacker capability going forward. Patch windows that once provided adequate buffer may no longer do so when capable models can close the gap between disclosure and exploitation at speed.

For further context on memory corruption exploit development and ASLR bypass techniques, the OWASP Foundation's vulnerability guidance provides a reputable reference for security teams assessing their exposure to this class of attack.