Claude Opus 5 Helped Researchers Chain Two Flaws and Take Over OpenAI Staff Accounts
Claude Opus 5 Helped Researchers Chain Two Flaws and Take Over OpenAI Staff Accounts
Three researchers at the security firm Hacktron used Anthropic's Claude Opus 5 to chain two flaws and take over the ChatGPT and Codex accounts of several OpenAI employees, then reach an internal OpenAI code repository. The chain began with a memory-corruption bug in the software running OpenAI's public help forum and moved through a weakness in OpenAI's own login system — and it is a demonstration of a class of risk every organization with shared single sign-on now owns.
This was security research, not a real-world attack. The team reported the flaws to OpenAI, proved the access with a harmless pull request, and stopped. From the first look, reaching internal access took under 72 hours. OpenAI confirmed a fix about 14 hours after the report and paid a $6,500 bounty on September 1, saying the award "recognizes the OpenAI-side finding, not the actions against Discourse," the open-source forum software. When one employee's Codex link to OpenAI's code on GitHub was opened, it triggered a single pull request in the internal repository — no source code was read, nothing was merged or shipped, and no customer data was touched. In theory, the same access could have extended to tools staff connect to ChatGPT and Codex, such as GitHub, Slack, and email. It was not used.
Why a Forum Bug Reached Staff Accounts
The reason a public forum compromise cascaded into staff account takeover lies in OpenAI's login system. The forum offers "Sign in with OpenAI" — the same single sign-on staff uses elsewhere. Once the researchers controlled the forum server, the shared login let them take over the ChatGPT and Codex accounts of forum members who worked at OpenAI, and the victims did not have to do anything. Hacktron called it an OpenAI identity problem, not a forum flaw: any service sharing that sign-on could have granted the same access.
The way in was an image bug. Discourse passes uploaded HEIC and HEIF images through ImageMagick, which uses the libheif library. A flaw in libheif — tracked as CVE-2026-32882, which Discourse's advisory rates as remote code execution at CVSS 8.8 — let a specially crafted image corrupt the forum server's memory, leaking data that defeats ASLR. The upstream fix shipped in libheif 1.22.0 in May 2026, but the forum's Debian 12 server image still carried the old 1.19.7 build when the researchers looked in July. Self-hosted Discourse operators should rebuild on the latest image — a web-interface update alone may not replace the old library. The fixed self-hosted releases are 2026.7.0, 2026.6.1, 2026.5.2, and 2026.1.6.
The AI Did the Hard Part
The researchers first tried Claude Opus 4.8, which struggled over several sessions to build a working exploit once ASLR was enabled. Anthropic released Claude Opus 5 on the evening of July 24 — and in a fresh session, it produced a working exploit within hours. The team got around Opus 5's safeguards by pointing the model at their own test server, disguised as a capture-the-flag practice target, and letting it run in an automated loop. Even so, they emphasize the work was not hands-off: skilled human direction still mattered.
The OpenAI work is one target in a wider project Hacktron calls HEIF Heist, which over about two months found the same class of image-decoding flaws in software used by other large companies at a total AI cost of under $3,000. The campaign reportedly links to disclosed bugs in Slack, Meta's products, GitHub Enterprise, and Next.js — the Next.js flaw is confirmed in Vercel's advisory, and libheif's maintainers confirmed a working code-execution exploit tied to Meta. Only one company, Shopify, appears to have noticed the testing activity.
What Should You Do?
- Update libheif everywhere it parses untrusted images — the latest security release is 1.23.4 as of early September 2026. Check your distribution's packaged version, not just upstream releases: the Debian lag is the whole story here.
- Self-hosted Discourse operators: rebuild on the latest server image. Discourse-hosted sites are already patched; fixed self-hosted releases are 2026.7.0, 2026.6.1, 2026.5.2, and 2026.1.6.
- Turn off decoding of untrusted HEIF and AVIF images where you don't need it, or run image processing in a locked-down sandbox. Image parsers accept attacker bytes before authentication on most forums and CMSs.
- Rethink SSO reach. A public, low-trust property sharing sign-on with internal tools turns any public compromise into an internal one. Limit which services your SSO trusts, and require a fresh identity check before sensitive actions rather than trusting an existing session.
The WAF Angle
Two lessons generalize far beyond OpenAI. First, image-decoding pipelines are upload surfaces: WAFs that validate HTTP semantics never see the memory corruption that follows a crafted HEIC, but a virtual patch that blocks or restricts HEIC/HEIF uploads on public forms meaningfully shrinks the blast radius — sandboxing image processing does the rest. Second, the identity system was the real target; the forum was only the door. When a low-trust property shares sessions with high-value tools, your effective security perimeter becomes the weakest service on the SSO graph — a theme WAFNinja has tracked from API gateway abuse to WAF admin compromise. And note the acceleration: Opus 4.8 failed against the same defense for days; Opus 5 succeeded within hours. Plan your defensive roadmap assuming the next model generation narrows the skill gap again.
