Claude Opus 5 Helped Researchers Take Over OpenAI Staff Accounts via Chained Flaws

Three security researchers used Anthropic's Claude Opus 5 to develop an exploit chain that moved from a vulnerable image-processing path in OpenAI's public forum to employee ChatGPT and Codex accounts, eventually reaching OpenAI's internal code repository.

Security researchers have demonstrated a striking example of how an AI coding agent can shorten the path from vulnerability discovery to a working exploit. In July 2026, researchers from Hacktron chained two separate security weaknesses to take over ChatGPT and Codex accounts belonging to OpenAI employees and then used one compromised Codex account to open a harmless pull request in OpenAI's internal repository.[1]

The researchers did not carry out a conventional criminal intrusion. They reported the findings to OpenAI and Discourse, stopped their testing after demonstrating the impact, and later received a $6,500 bounty from OpenAI for the OpenAI-side vulnerability.[1][2]

What makes the case particularly notable is the role of Claude Opus 5[3]. The researchers said an earlier Claude model struggled to produce a reliable exploit for the underlying memory-safety issue. After Opus 5 was released on July 24, 2026, the team gave it the same problem and obtained a working exploit within hours.[1]

What Happened in the OpenAI Security Research

The initial target was not OpenAI's core application infrastructure. It was community.openai.com, the company's public help and discussion forum, which runs on Discourse.[1]

The researchers discovered that the forum's handling of HEIC and HEIF images could expose an older version of the libheif image-processing library to attacker-controlled files. Discourse subsequently published a security advisory confirming that an upstream libheif vulnerability could be used for remote code execution through image uploads.[4]

The important detail is that there were actually two different security issues involved in the chain.

1. A memory-safety vulnerability in the image-processing software provided a path to code execution on the Discourse forum server.
2. A separate weakness in OpenAI's sign-in infrastructure allowed access from the compromised forum environment to users' ChatGPT and Codex accounts.

The second issue is what transformed a compromised public-facing forum into a potential path toward internal OpenAI resources. Hacktron described the problem as an OpenAI identity and single-sign-on issue rather than a vulnerability in Discourse itself.[1]

The HEIF Image Upload Was the Starting Point

HEIF and HEIC are image formats commonly associated with modern cameras and smartphones. Discourse's image-processing pipeline handled these files differently from formats supported by its normal image-checking path, ultimately bringing ImageMagick and libheif into the processing chain.[1][2]

The underlying libheif vulnerability is tracked as CVE-2026-32882.[5] The upstream libheif advisory describes it as a heap out-of-bounds read in the overlay-compositing code. A crafted HEIF file could cause the decoder to read beyond the intended alpha buffer, potentially resulting in a crash or disclosure of adjacent heap memory.[5]

That description is narrower than the way the vulnerability was later characterized by Discourse. Discourse's own advisory treats the issue as an RCE vulnerability in the context of its image-upload processing and assigns it a CVSS v3.1 score of 8.8.[4]

This distinction matters when describing the incident. The upstream vulnerability record and the Discourse-specific advisory are not assigning the same severity to exactly the same security context.

Two CVSS Views of the Same Underlying Issue

The upstream libheif advisory assigns CVSS v3.1: 7.1 (High), with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H.[5] The advisory identifies the weakness as CWE-125, Out-of-bounds Read.[5]

Discourse's advisory, by contrast, assigns CVSS v3.1: 8.8 (High), using the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.[4] Discourse's score reflects the impact of the vulnerability when reached through its own image-upload functionality.

That difference should not be silently collapsed into a single "CVSS 8.8" statement. The 7.1 score comes from the libheif project's vulnerability context, while the 8.8 score comes from Discourse's product-specific assessment.[4][5]

How a Forum Vulnerability Became an Account-Takeover Problem

A compromised forum normally should not automatically provide access to an organization's internal engineering systems. The OpenAI research demonstrated why identity architecture can change that assumption.

OpenAI's community forum offered a Sign in with OpenAI option. According to Hacktron's disclosure, the researchers found that compromising the forum could be chained with a weakness in the OpenAI sign-in flow, allowing them to take over the ChatGPT and Codex accounts of users who had authenticated through the service.[1]

That included OpenAI employees.

The researchers then found that one employee's Codex account was connected to OpenAI's GitHub organization. Rather than reading internal source code, they used the compromised account to instruct Codex to open a pull request in the internal repository as a proof of impact.[1][2]

The demonstration was deliberately limited. Hacktron reported that it did not read or download OpenAI's internal source code, merge the pull request, ship changes, or access customer data.[1]

That distinction is important. The research demonstrated a path to sensitive internal infrastructure, but it does not establish that the researchers exfiltrated OpenAI's proprietary source code.

Claude Opus 5 Changed the Exploit Development Timeline

The AI component is arguably the most unusual part of the incident.

Hacktron said its researchers initially worked with Claude Opus 4.8 while trying to turn the underlying memory-safety problem into a reliable exploit. The model struggled to produce a working exploit with modern memory protections enabled.[1][2]

Anthropic released Claude Opus 5 on July 24, 2026.[3] The researchers then presented the newer model with the same technical challenge. According to their account, Opus 5 produced a working exploit within hours.[1]

The researchers still directed the operation. This was not a case of an AI independently deciding to attack OpenAI, selecting the target, obtaining authorization, and carrying out the entire operation without human involvement. The humans chose the target, supplied the technical context, evaluated the results and decided how far the testing would go.[1]

Claude nevertheless played a meaningful role in the difficult middle portion: developing an exploit capable of turning a memory-corruption bug into practical code execution under a real system configuration.

That is a meaningful change in offensive-security economics. A vulnerability that previously required substantial manual reverse engineering and exploit-development expertise can potentially become much faster to operationalize when a capable coding agent can repeatedly analyze failures, modify code and test new approaches.

The Attack Chain in Plain English

The complete chain can be understood without reproducing the exploit itself:

1. Public forum: The researchers investigated OpenAI's public community forum running on Discourse.[1]
2. Image processing: HEIC/HEIF uploads reached ImageMagick and the vulnerable libheif component.[1][4]
3. Memory-safety flaw: The researchers developed the underlying vulnerability into remote code execution in the Discourse environment.[1][4]
4. Identity escalation: They identified a separate weakness in OpenAI's sign-in infrastructure.[1]
5. Employee accounts: The chain allowed access to ChatGPT and Codex accounts belonging to OpenAI employees.[1]
6. Connected service: One employee's Codex account was connected to OpenAI's GitHub organization.[1]
7. Proof of impact: The researchers instructed Codex to create a harmless pull request in an internal repository, then stopped testing.[1]

The crucial security lesson is that none of these components needed to be catastrophic in isolation. The impact came from chaining them.

Why the SSO Weakness Matters More Than the Forum

The forum vulnerability was the entry point, but the identity boundary determined how far the compromise could travel.

If a public community application can be compromised and the resulting server access can obtain credentials or tokens that remain useful against internal services, the security boundary between "public" and "internal" becomes much weaker than it appears.

Hacktron specifically argued that the OpenAI-side weakness was not inherently limited to Discourse. The researchers said that another first-party or third-party service using the same vulnerable OpenAI sign-in mechanism could potentially have provided a similar escalation path if compromised.[1]

That is why organizations should treat single sign-on integrations as part of their attack surface rather than as a purely administrative convenience.

OpenAI and Discourse Fixed Their Sides of the Chain

According to Hacktron's disclosure, OpenAI confirmed its fix roughly 14 hours after the researchers reported the OpenAI-side issue. OpenAI later paid the team $6,500 and marked the report resolved.[1][2]

Discourse separately addressed the image-processing vulnerability. Its official advisory lists patched releases 2026.7.0, 2026.6.1, 2026.5.2 and 2026.1.6 and says the latest Discourse Docker image contains the patched libheif version.[4]

For self-hosted Discourse deployments, the project recommends updating and rebuilding the application image. The advisory also describes additional sandboxing around image processing in the affected releases.[4]

The upstream libheif project fixed CVE-2026-32882 in libheif 1.22.0.[5] The project's release history confirms that version 1.22.0 included the security fix for the heap out-of-bounds read.[6]

What Security Teams Should Learn From the Incident

The incident is not simply a story about an AI model becoming better at hacking. The underlying chain contains several conventional security lessons that apply to organizations well beyond AI companies.

1. Patch the Dependency, Not Just the Application

A web application can be fully updated while a vulnerable native library remains inside its container image or operating-system package. Image-processing libraries deserve particular attention because they routinely process attacker-controlled files.

Organizations accepting HEIF, HEIC or other complex media formats should know exactly which decoder libraries process those files and which versions are installed in production.

2. Treat File Decoders as Security Boundaries

Image, document, archive and media parsers routinely process data supplied by users or external systems. Memory-safety bugs in these components can become serious when the parser runs with excessive privileges.

Where possible, untrusted media processing should run with minimal privileges and appropriate isolation. Discourse's addition of image-processing sandboxing is an example of defense in depth: patching removes a known vulnerable condition, while isolation can limit the consequences of future decoder bugs.[4]

3. Reassess Shared SSO Across Trust Boundaries

A public community service and an internal engineering platform do not necessarily deserve the same trust level.

When both rely on the same identity infrastructure, security teams should examine what happens if the less-trusted application is compromised. Tokens should be narrowly scoped, sensitive operations should require appropriate reauthentication or additional controls, and access from compromised application contexts should not automatically inherit broad privileges.

4. Review Connected AI Agents

The Codex portion of the demonstration also shows why connected AI agents need careful authorization boundaries. The employee account was not valuable merely because it could log into ChatGPT. Its importance came from the services connected to it.

An AI coding assistant with access to a private repository can become a powerful action interface. That makes identity, token scope, repository permissions and agent authorization part of the same security problem.

Was OpenAI Actively Hacked by Criminal Attackers?

The available evidence does not support describing this incident as a criminal attack against OpenAI customers or employees.

Hacktron describes the work as security research, reported the vulnerabilities, limited its proof of impact and stopped after opening the demonstration pull request.[1] OpenAI subsequently confirmed the OpenAI-side finding through its remediation and bounty payment.[1][2]

There is also an important distinction between demonstrating that a vulnerability can be exploited and proving that criminals used the same chain against OpenAI in the wild. The reporting reviewed for this article describes the Hacktron research operation; it does not establish a separate real-world criminal campaign exploiting the same chain against OpenAI.

That distinction should remain in any discussion of the incident.

The Bigger AI Security Question

Claude Opus 5 did not create the vulnerabilities in OpenAI's infrastructure. It did not design the identity architecture. It did not decide that the public forum should trust the same authentication infrastructure used by other OpenAI services.

What changed was the speed at which researchers could move from a difficult memory-corruption problem to a working exploit.

That matters because defenders normally rely on time. A vulnerability may be known but difficult to exploit reliably. A capable AI system can reduce some of that engineering friction. The window between disclosure, discovery and practical exploitation can therefore become shorter even when the underlying vulnerability class has existed for years.

Anthropic's own research into cybersecurity incidents also shows why the behavior of advanced models needs to be evaluated carefully. Anthropic reported that its newer models, including Claude Opus 5, showed lower rates of harmful behavior than some other models in its controlled evaluations, while emphasizing that those results came from simulated environments and do not directly establish how the models would behave in ordinary use.[7]

The Hacktron case is different: human researchers intentionally used the model as part of a real security-research workflow. That makes it a useful example of augmentation rather than autonomous cyberattack.

Security Takeaway

The most important part of the OpenAI incident is not that an AI model "hacked OpenAI." That description leaves out the architecture that made the chain possible.

A vulnerable image decoder provided the initial foothold. A public-facing forum exposed that decoder to attacker-controlled input. A separate identity weakness allowed the compromise to cross into OpenAI accounts. A connected Codex account then provided a path toward an internal GitHub environment.

Claude Opus 5 helped make the exploit-development stage dramatically faster, according to the researchers. But the final impact came from the interaction of software vulnerabilities, identity trust and connected permissions.

For defenders, that is the practical lesson. Patch deeply, isolate untrusted parsers, keep public services separated from sensitive identity boundaries, and treat every connected AI agent as another privileged interface that needs strict authorization controls.

Sources & References

1. [1] The Hacker News — Claude Opus 5 Helped Researchers Take Over OpenAI Staff Accounts via Chained Flaws — September 19, 2026 — Original report
2. [2] The Register — Researchers used Claude to hack OpenAI employees' ChatGPT accounts — September 18, 2026 — Security report
3. [3] Anthropic — Introducing Claude Opus 5 — July 24, 2026 — Anthropic announcement
4. [4] Discourse — RCE via malformed HEIF file — July 28, 2026 — Discourse security advisory
5. [5] strukturag/libheif — Heap Buffer OOB Read in overlay compositing due to wrong alpha stride — May 19, 2026 — libheif security advisory
6. [6] strukturag/libheif — Release v1.22.0 — May 19, 2026 — libheif v1.22.0 release
7. [7] Anthropic — An alignment assessment of recent cybersecurity incidents — September 9, 2026 — Anthropic research assessment

Editorial note: The CVSS values in this article are reported separately because the upstream libheif advisory and the Discourse product advisory assess the vulnerability in different contexts. The article does not treat the upstream CVE description as independently proving remote code execution; the RCE characterization is specifically supported by the Discourse advisory and the reported research chain.[4][5]