Three researchers at the security firm Hacktron used Anthropic's Claude Opus 5 to chain two flaws and take over the ChatGPT and Codex accounts of several OpenAI employees, then reach an internal OpenAI code repository.
The chain began with a bug in the software that runs OpenAI's public help forum and moved through a weakness in OpenAI's own login system.
This was security research, not a real-world attack: the team reported the flaws to OpenAI, proved the access with a harmless pull request, and then stopped. From the first look, that internal access took under 72 hours.
OpenAI confirmed a fix about 14 hours after the report, according to Hacktron, and on September 1 paid the team a $6,500 bounty. OpenAI said the award "recognizes the OpenAI-side finding, not the actions against Discourse," the open-source software that runs the forum. Testing the forum itself was outside its bug bounty program.
OpenAI has not publicly described the login flaw, and it confirmed the finding through that fix and payment rather than by detailing the account takeovers.
Hacktron, which describes itself as an AI-assisted security research firm, was careful about what it did and did not do. When one employee's Codex link to OpenAI's code on GitHub was opened, it triggered a single pull request in the internal repository. It did not read any source code, merge or ship anything, or touch customer data.
What the chain could have reached was far larger. Because staff connects other services to ChatGPT and Codex, the team said the same access could in theory have extended to tools such as GitHub, Slack, and email. That wider reach was possible, but not used.
Why a Forum Bug Reached Staff Accounts
The reason a bug in a public forum could reach staff accounts lies in OpenAI's login system, not in the forum software. OpenAI's forum offers a "Sign in with OpenAI" option, the same single sign-on (SSO) that staff uses elsewhere.
Once the researchers took control of the forum server, the shared login let them take over the ChatGPT and Codex accounts of forum members who worked at OpenAI. The victims did not have to do anything.
Hacktron said this was an OpenAI identity problem, not a flaw in the forum software: any first- or third-party service using the same sign-on could have granted the same access.
The way in was an image bug. The forum runs on Discourse, and Discourse passes uploaded HEIC and HEIF images to a tool called ImageMagick, which uses the libheif library to read them. A flaw in libheif let a specially crafted image corrupt the forum server's memory.
Discourse's advisory rates the result as remote code execution, scores it 8.8 out of 10, and tracks it as CVE-2026-32882. The public record for the flaw itself is narrower. In libheif's own advisory and in national vulnerability databases, CVE-2026-32882 is an out-of-bounds read that can crash the software or leak nearby memory, not a direct code-execution bug.
That leaked memory helps defeat a common protection called ASLR. The researchers say they combined libheif's memory bugs, with the AI's help, to turn the crash into working code execution on the forum server. Upstream, the flaw was fixed in libheif 1.22.0 in May 2026.
That fix existed months before the test. But the forum's server image, built on the Debian 12 Linux distribution, still shipped the old, unpatched libheif, version 1.19.7, when the researchers looked in July. The fix and its CVE were already public, but Debian had not yet included them in the packaged version the forum used.
If you run your own Discourse server, this part affects you directly. Rebuild on the latest image to get the patched libheif, because a web-interface update alone may not replace the old library. Sites hosted by Discourse were already patched, and the fixed self-hosted releases are 2026.7.0, 2026.6.1, 2026.5.2, and 2026.1.6.
How the Researchers Used AI
The researchers used AI to do the hard part. They first tried Claude Opus 4.8, which struggled over several sessions to build a working exploit once a standard memory defense, ASLR, was enabled.
Anthropic released its next model, Claude Opus 5, on the evening of July 24, and in a fresh session it produced a working exploit within hours.
Opus 5 shipped with safeguards meant to stop it from writing exploit code for real targets. The researchers got around them by pointing the model at their own test server, disguised as a capture-the-flag practice target, then letting it run in an automated loop. Even so, they say the work was not hands-off: skilled human direction still mattered, and this was not automated hacking with no one at the controls.
The case fits what researchers and AI companies have described this year: capable AI models are sharply cutting the time and skill that serious offensive work used to take. Anthropic has reported that criminal and state-backed groups are already using its Claude models to run real intrusions, not just to answer questions.
OpenAI was one target in a wider project Hacktron calls HEIF Heist. Over about two months, the team says, it found the same class of image-decoding flaws in software used by other large companies, at a total cost of under $3,000 in AI usage. It links the campaign to reported bugs in Slack, Meta's products, GitHub Enterprise, and web frameworks such as Next.js.
Those broader claims are backed unevenly. The Next.js flaw is confirmed in Vercel's own advisory, and libheif's maintainers confirmed a working code-execution exploit for the bug tied to Meta. The wider claim of code execution across many applications has not been independently confirmed, a limit The Hacker News noted when it first covered the Next.js flaw in August.
The wider campaign used a different model, OpenAI's own GPT-5.6 Sol, for cases where the team knew nothing about the target in advance. Only one company, Shopify, appears to have noticed the activity, the researchers say, even though its image processors crashed repeatedly under thousands of test uploads.
The Hacker News has contacted Hacktron with questions about how the forum code execution was achieved and about the scope of the account access.
What to Do
The bigger lessons go beyond Discourse. If your service accepts user images and reads HEIC, HEIF, or AVIF files through libheif, an old build could be exposed.
And if a public, lower-trust service shares your single sign-on with internal tools, a break-in on that service can become a break-in everywhere the same login reaches.
- Update libheif to the latest security release (1.23.4 as of early September 2026) or to your distribution's patched build.
- Where you do not need it, turn off decoding of untrusted HEIF and AVIF images, or run image processing inside a locked-down sandbox.
- Limit which services your single sign-on trusts, and require a fresh identity check before sensitive actions rather than trusting an existing session.
There is no sign the OpenAI flaw was used against anyone in the real world. As of mid-September 2026, it was not on the U.S. government's list of vulnerabilities known to be exploited, though that list is not proof either way.
What the available reports do not settle is whether an organization that has already patched should still check for earlier access; on that point, the sources are silent.
Facts Only
* Hacktron researchers used Claude Opus 5 to access OpenAI employee accounts.
* The attack chain involved a bug in Discourse forum software and a weakness in OpenAI's login system.
* Access was gained to ChatGPT and Codex accounts and an internal code repository.
* The researchers submitted a single harmless pull request to prove access.
* OpenAI paid a $6,500 bounty on September 1, 2026.
* The technical entry point was CVE-2026-32882, an out-of-bounds read in the libheif library.
* The forum server used libheif version 1.19.7; the fix was released in version 1.22.0 in May 2026.
* Claude Opus 5 produced a working exploit within hours after its July 24 release.
* Hacktron identified similar image-decoding flaws in software used by Meta, Slack, GitHub Enterprise, and Next.js.
* The "HEIF Heist" project utilized GPT-5.6 Sol for targets where no prior information existed.
Executive Summary
Security researchers at Hacktron successfully chained a memory corruption vulnerability in the libheif library with a flaw in OpenAI's single sign-on (SSO) implementation to gain unauthorized access to internal employee accounts and code repositories. The breach originated in a public help forum running an unpatched version of Discourse. Because the forum shared an identity provider with internal tools, the researchers could pivot from the forum server to staff ChatGPT and Codex accounts without user interaction.
The operation highlights a significant shift in offensive capabilities, as the researchers transitioned from struggling with Claude Opus 4.8 to rapidly developing a working exploit using Claude Opus 5. While OpenAI has since patched the login flaw and paid a bounty, the broader "HEIF Heist" campaign suggests a systemic vulnerability in how various large-scale platforms handle HEIC/HEIF image decoding. There remains some uncertainty regarding the full extent of the campaign's success, as claims of code execution across multiple other major platforms have not been independently confirmed.
Full Take
The strongest version of this narrative is a cautionary tale about the compounding risks of "convenience" in security: specifically, the danger of sharing a single sign-on (SSO) across high-trust internal tools and low-trust public-facing forums. It serves as a technical proof-of-concept for the accelerating "time-to-exploit" enabled by next-generation LLMs.
The narrative relies on a distinct pattern of escalating stakes. It begins with a specific, resolved bug and expands into a "wider project" (HEIF Heist) involving multiple tech giants, yet the evidence for these broader claims is notably thinner—relying on "unevenly backed" assertions and crashes rather than confirmed breaches. This creates a persuasive push toward the idea of an AI-driven security crisis, while the concrete evidence remains localized to a few specific instances.
Patterns detected: ARC-0024 Ambiguity
The root cause is the fragile assumption that perimeter defenses (like patching a library) are sufficient when the architectural design (SSO) creates a "flat" identity landscape. This echoes the historical shift from defending the castle walls to the "Zero Trust" paradigm, where the identity itself is the perimeter.
The implication is a narrowing window for defenders. When the "hard part" of exploit development—defeating ASLR and writing stable shellcode—is reduced from days of skilled labor to hours of AI-assisted looping, human agency in defense must shift from manual patching to systemic isolation and sandboxing.
Bridge Questions:
1. If AI can accelerate the exploit cycle, can it equivalently accelerate the "discovery-to-patch" cycle for defenders?
2. To what extent does the public disclosure of "AI-assisted" breaches serve as a marketing tool for security firms to justify new toolsets?
Counterstrike Scan: A coordinated campaign would use this to trigger panic among enterprise CTOs to force immediate migration to a specific "AI-hardened" security vendor. This content does not match that pattern; it provides specific technical CVEs and actionable mitigation steps.