Hacktron uses Claude Opus 5 to breach OpenAI staff accounts in under 72 hours

September 22, 2026 at 05:30 PM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

Researchers at Hacktron used Claude Opus 5 to develop an exploit chain that compromised ChatGPT and Codex accounts of several OpenAI employees in under 72 hours. The attack began with a memory corruption flaw in libheif on OpenAI's community forum, leading to remote code execution and access to internal systems. OpenAI fixed the vulnerability within 14 hours and paid a $6,500 bug bounty.

Key Facts

Hacktron researchers achieved remote code execution on community.openai.com by exploiting a libheif memory corruption flaw (CVE-2026-32882, CVSS 8.8).
Claude Opus 5 helped refine the exploit to bypass ASLR in just a few hours, after Claude Opus 4.8 failed to produce a working exploit.
The compromised forum server allowed access to OpenAI employee ChatGPT and Codex accounts via the Sign in with OpenAI SSO integration.
OpenAI patched the vulnerability within 14 hours and paid Hacktron a $6,500 bug bounty, even though the forum was outside the bounty scope.
Discourse later released a patch adding a sandbox for image processing to prevent similar attacks.

Exploit Chain

The initial entry point was community.openai.com, OpenAI's official Discourse-based forum. The server used ImageMagick and libheif to process uploaded HEIF/HEIC images, where researchers found a memory corruption bug. The vulnerability, CVE-2026-32882, was rated 8.8 on the CVSS scale and involved an out-of-bounds read that could cause memory leaks or crashes. Researchers combined multiple flaws to achieve full remote code execution, despite the server running an outdated libheif 1.19.7 on Debian 12. The fix for the bug had been available since May 2026 in libheif 1.22.0, but the server image had not been updated.

AI-Assisted Exploitation

Hacktron initially used Claude Opus 4.8, but the model could not produce a working exploit against ASLR. After Claude Opus 5 was released, researchers repeated the experiment and the new model helped finalize the exploit within hours. The researchers achieved remote code execution on the forum server, which then enabled further attacks.

Post-Exploitation and Response

After compromising the forum, researchers exploited a flaw in OpenAI's single sign-on (SSO) system to access employee ChatGPT and Codex accounts without user interaction. Through one account, they accessed Codex connected to OpenAI's GitHub organization and created a harmless pull request in the internal monorepo to demonstrate impact. The researchers noted that similar access could theoretically extend to other connected services like Slack and email. Hacktron immediately notified OpenAI, which fixed the issue in about 14 hours and paid a $6,500 bounty. OpenAI clarified that the forum was not part of the bug bounty program, so the reward was for the vulnerability on OpenAI's side. Discourse subsequently released a patch adding a sandbox for image processing.