Researchers Used Claude Opus 5 to Chain Flaws and Access OpenAI Staff Accounts
Summary
Hacktron researchers used Claude Opus 5 to help exploit a libheif flaw in OpenAI’s forum and chain it with a login weakness, accessing employee ChatGPT and Codex accounts in a controlled test. OpenAI fixed the issue and paid a bounty.
Key points
- Researchers chained a libheif image-processing flaw in OpenAI’s Discourse forum with a weakness in OpenAI’s shared sign-in system to access employee ChatGPT and Codex accounts.
- The libheif flaw allowed memory corruption; researchers say they used the resulting memory leak to bypass ASLR and achieve code execution on the forum server.
- The team says Claude Opus 5 produced a working exploit within hours, with skilled human direction and an automated loop; they framed the target as a capture-the-flag practice server to work around model safeguards.
- Researchers say the test was not a real-world attack. They submitted one harmless pull request to demonstrate access and did not read source code, modify or ship code, or access customer data.
- Hacktron said OpenAI fixed its login issue about 14 hours after the report and paid a $6,500 bounty on September 1. OpenAI said the award recognized the OpenAI-side finding, not the Discourse actions.
- The forum server used libheif 1.19.7 despite an upstream fix in 1.22.0. The article recommends updating libheif, isolating image processing, and limiting which services share single sign-on.
- Hacktron’s broader claims about similar flaws across other companies are unevenly confirmed; the article reports no evidence that the OpenAI flaw was used against anyone in the wild.
Article Details
- Attack Vectors
- Researchers uploaded a specially crafted HEIC/HEIF image to exploit a libheif memory flaw in the Discourse forum server; they report combining memory bugs to bypass ASLR and achieve code execution.
- After gaining control of the forum server, the researchers used OpenAI's shared Sign in with OpenAI SSO to access ChatGPT and Codex accounts belonging to OpenAI employees.
- A Codex link opened by a researcher triggered one pull request in an internal OpenAI repository; the researchers said they did not read source code, merge or ship changes, or access customer data.
- Defensive Notes
- Update libheif to the latest security release or a patched distribution build. The article identifies libheif 1.22.0 as the upstream fix for CVE-2026-32882 and 1.23.4 as the latest security release as of early September 2026.
- For self-hosted Discourse, rebuild on a current image so the patched libheif library is included; the article lists fixed releases 2026.7.0, 2026.6.1, 2026.5.2, and 2026.1.6.
- Disable decoding of untrusted HEIF and AVIF images where unnecessary, or isolate image processing in a locked-down sandbox.
- Limit which services trust the same SSO, and require a fresh identity check before sensitive actions rather than relying on an existing session.
MITRE ATT&CK
T1068 · Exploitation for Privilege EscalationThe researchers say they combined libheif memory bugs to bypass ASLR and turn a crash into code execution on the forum server.T1190 · Exploit Public-Facing ApplicationThe researchers exploited a specially crafted image to gain code execution on the publicly accessible Discourse forum server.T1550.001 · Application Access TokenThe researchers used OpenAI's shared SSO access to take over employee ChatGPT and Codex accounts after compromising the forum server.
CVE
Vendors
AnthropicThree researchers at the security firm Hacktron used Anthropic’s Claude Opus 5 to chain two flaws and take over the ChatGPT and Codex accounts of several OpenAI employees, then reach an internal OpenAI code repository.OpenAIHacktron researchers used Claude Opus 5 to chain a Discourse image bug and an OpenAI login weakness, briefly taking over ChatGPT and Codex accounts belonging to OpenAI employees and reaching an internal code repository.
Products
ChatGPTHacktron researchers used Claude Opus 5 to chain a Discourse image bug and an OpenAI login weakness, briefly taking over ChatGPT and Codex accounts belonging to OpenAI employees and reaching an internal code repository.Claude Opus 4.8They first tried Claude Opus 4.8, which struggled over several sessions to build a working exploit once a standard memory defense, ASLR, was enabled.Claude Opus 5Hacktron researchers used Claude Opus 5 to chain a Discourse image bug and an OpenAI login weakness, briefly taking over ChatGPT and Codex accounts belonging to OpenAI employees and reaching an internal code repository.CodexHacktron researchers used Claude Opus 5 to chain a Discourse image bug and an OpenAI login weakness, briefly taking over ChatGPT and Codex accounts belonging to OpenAI employees and reaching an internal code repository.DiscourseHacktron researchers used Claude Opus 5 to chain a Discourse image bug and an OpenAI login weakness, briefly taking over ChatGPT and Codex accounts belonging to OpenAI employees and reaching an internal code repository.GPT-5.6 SolThe wider campaign used a different model, OpenAI’s own GPT-5.6 Sol, for cases where the team knew nothing about the target in advance.ImageMagickThe forum runs on Discourse, and Discourse passes uploaded HEIC and HEIF images to a tool called ImageMagick, which uses the libheif library to read them.libheifOpenAI fixed the issue quickly and paid a bounty, while the underlying HEIF/HEIC flaw was tied to libheif and affected Discourse-based systems.Next.jsIt links the campaign to reported bugs in Slack, Meta’s products, GitHub Enterprise, and web frameworks such as Next.js.