Claude Opus 5

Three researchers at Hacktron just pulled off something wild. They used Anthropic's Claude Opus 5 to take over the ChatGPT and Codex accounts of several OpenAI employees. Then they reached an internal OpenAI code repository.

This wasn't an attack. It was security research. They reported the flaws, proved the access with a harmless pull request, and stopped. From first look to internal access, the whole thing took under 72 hours.

OpenAI fixed it about 14 hours after the report. On September 1, they paid the team $6,500. OpenAI says the bounty recognizes the OpenAI-side finding, not the actions against Discourse, the open-source forum software.

So how did they do it? And what does it say about where we're headed?

The Short Version

The Image Bug That Started It All

OpenAI's help forum runs on Discourse. Like most forums, it lets people upload images. HEIC and HEIF files specifically.

Those images get passed to ImageMagick, which uses a library called libheif to read them. And libheif had a bug.

A specially crafted image could corrupt the forum server's memory. Discourse rates the result as remote code execution. They scored it 8.8 out of 10. The CVE is CVE-2026-32882.

But here's a wrinkle. The public record for that CVE is narrower. In libheif's own advisory, it's an out-of-bounds read. It can crash the software or leak nearby memory. It's not a direct code-execution bug.

That leaked memory helps defeat ASLR a common protection that randomizes where things sit in memory. The researchers combined the memory bugs with AI's help to turn a crash into working code execution on the forum server.

The fix landed in libheif 1.22.0 back in May 2026. Months before the test.

But the forum's server image built on Debian 12 still shipped the old, unpatched version when the researchers looked in July. Version 1.19.7. The fix and its CVE were already public. Debian just hadn't packaged them yet.

That's a detail worth sitting with.

Why a Forum Bug Reached Staff Accounts

This is the part that matters most. A bug in a public forum shouldn't let you into staff accounts. But it did.

The reason isn't Discourse. It's OpenAI's login system.

OpenAI's forum offers "Sign in with OpenAI." It's the same single sign-on that staff uses everywhere else.

Once the researchers controlled the forum server, that shared login let them take over the ChatGPT and Codex accounts of forum members who worked at OpenAI. The victims didn't have to do anything.

Hacktron calls this an OpenAI identity problem, not a forum flaw. Any first- or third-party service using the same sign-on could have granted the same access.

And the potential reach was bigger. Because staff connects other services to ChatGPT and Codex, the same access could theoretically have extended to GitHub, Slack, and email. That wider reach was possible, but not used.

How Claude Opus 5 Changed the Game

The researchers tried Claude Opus 4.8 first. It struggled. Several sessions, no working exploit once ASLR was enabled.

Then Anthropic released Claude Opus 5 on the evening of July 24. In a fresh session, it produced a working exploit within hours.

Opus 5 ships with safeguards meant to stop it from writing exploit code for real targets. The researchers got around them by pointing the model at their own test server, disguised as a capture-the-flag target. Then they let it run in an automated loop.

Even so, they say it wasn't hands-off. Skilled human direction still mattered. This wasn't automated hacking with nobody at the controls.

But it fits a pattern we've seen all year. Capable AI models are sharply cutting the time and skill that serious offensive work used to take. Anthropic itself has reported that criminal and state-backed groups are already using Claude to run real intrusions.

The Wider Campaign: HEIF Heist

OpenAI was just one target.

Hacktron calls the broader project HEIF Heist. Over about two months, they found the same class of image-decoding flaws in software used by other big companies. Total cost in AI usage: under $3,000.

They link the campaign to reported bugs in Slack, Meta's products, GitHub Enterprise, and web frameworks like Next.js.

How solid are those claims? Mixed.

• The Next.js flaw is confirmed in Vercel's own advisory.
• Libheif's maintainers confirmed a working code-execution exploit for the bug tied to Meta.
• But the wider claim of code execution across many applications hasn't been independently confirmed.

The wider campaign used a different model OpenAI's own GPT-5.6 Sol for cases where the team knew nothing about the target in advance.

Only one company, Shopify, appears to have noticed the activity. Even though its image processors crashed repeatedly under thousands of test uploads.

What You Should Do

The lessons go beyond Discourse.

• Update libheif. If your service reads HEIC, HEIF, or AVIF files through libheif, an old build could be exposed. Update to 1.23.4 or your distribution's patched build.
• Turn off untrusted image decoding. Where you don't need it, disable HEIF and AVIF decoding. Or run image processing in a locked-down sandbox.
• Rebuild your Discourse server. If you self-host Discourse, rebuild on the latest image. A web-interface update alone may not replace the old library. Fixed self-hosted releases: 2026.7.0, 2026.6.1, 2026.5.2, 2026.1.6.
• Limit SSO trust. If a public, lower-trust service shares your single sign-on with internal tools, a break-in there becomes a break-in everywhere. Limit which services your SSO trusts.
• Require fresh identity checks. For sensitive actions, require a fresh check. Don't trust an existing session.

The Bottom Line

Hacktron used Claude Opus 5 to chain two flaws and take over OpenAI employees' accounts. They reached an internal code repository. It was research. They reported it, proved it, and stopped. OpenAI fixed it and paid a bounty.

But the bigger picture matters more. AI is making exploit development faster and cheaper. And shared single sign-on can turn a small flaw in a public service into a major breach.

There's no sign the OpenAI flaw was used against anyone in the real world. As of mid-September 2026, it wasn't on the U.S. government's known exploited list. But that list isn't proof either way.

Quick Reference

What to Do

• Update libheif to 1.23.4
• Turn off untrusted HEIF/AVIF decoding
• Rebuild Discourse on latest image
• Limit SSO trust
• Require fresh identity checks for sensitive actions

FAQ Section

What did Hacktron do?

They used Claude Opus 5 to chain two flaws, take over OpenAI employees' ChatGPT and Codex accounts, and reach an internal OpenAI code repository. It was security research, and they reported it.

How did the attack work?

A libheif bug in OpenAI's Discourse forum let them execute code on the forum server. Then an OpenAI SSO weakness let them take over staff accounts.

What is CVE-2026-32882?

A libheif out-of-bounds read. Discourse rates it as remote code execution. Public records describe it as a crash or memory leak. The researchers combined it with other bugs to get code execution.

Why did OpenAI pay a bounty?

OpenAI said the award recognizes the OpenAI-side finding, not the actions against Discourse. Testing the forum was outside its bug bounty program.

What should I do?

Update libheif. Turn off untrusted HEIF/AVIF decoding. Rebuild Discourse on the latest image. Limit SSO trust. Require fresh identity checks for sensitive actions.

Source: The Hacker News