Claude Opus 5 Helped Researchers Take Over OpenAI Staff Accounts via Chained Flaws
Security researchers at Hacktron exploited two flaws in OpenAI's systems – a vulnerability in Discourse's image processing and a weakness in OpenAI's login system – to gain access to OpenAI staff accounts and a code repository. They used Claude Opus 5, leveraging AI to bypass safeguards and craft an exploit. The incident highlights the increasing role of AI in offensive security and the potential for vulnerabilities to be exploited across multiple services when a single sign-on is compromised. While the vulnerability was patched, the researchers are investigating whether previously patched systems were still vulnerable to earlier access.
Three researchers at the security firm Hacktron exploited two flaws in OpenAI's systems – a bug in the software that runs OpenAI's public help forum (Discourse) and a weakness in OpenAI's login system – to gain access to OpenAI staff accounts and a code repository. The chain began with a bug in Discourse’s image processing, specifically related to handling HEIC and HEIF images through the libheif library. This led to a remote code execution vulnerability, allowing them to trigger a crash on the forum server and ultimately execute code.
Hacktron then leveraged Anthropic’s Claude Opus 5, an AI model, to bypass safeguards and craft an exploit. Initially, Claude Opus 4.8 struggled to produce a working exploit, but the release of Claude Opus 5 dramatically improved the process, allowing the researchers to create a working exploit within hours. The AI model was used to bypass protections designed to prevent it from writing exploit code for real targets, by pointing it at their own test server disguised as a capture-the-flag practice target.
Despite the vulnerability being patched, Hacktron discovered that the same login system used by staff could be exploited to access other services, including GitHub, Slack, and email, due to OpenAI’s single sign-on (SSO) system. The researchers emphasized that this was an OpenAI identity problem, not a flaw in Discourse itself. They also noted that the vulnerability existed for months before the test, with the fix and CVE already public, but Debian had not yet included it in the packaged version the forum used.
Beyond Discourse, Hacktron’s research revealed similar vulnerabilities in other software used by large companies, including Slack, Meta’s products, GitHub Enterprise, and web frameworks like Next.js. They used OpenAI’s own GPT-5.6 Sol model for cases where they had no prior knowledge of the target’s software. Shopify was the only company that appeared to have noticed the activity.
As of mid-September 2026, the U.S. government’s list of vulnerabilities known to be exploited did not include the OpenAI flaw, though this list is not definitive. Hacktron is currently investigating whether previously patched systems were still vulnerable to earlier access.
**What to Do:**
- Update libheif to the latest security release (1.23.4 as of early September 2026) or to your distribution’s patched build.
- Where you do not need it, turn off decoding of untrusted HEIF and AVIF images, or run image processing inside a locked-down sandbox.
- Limit which services your single sign-on trusts, and require a fresh identity check before sensitive actions rather than trusting an existing session.