Researchers Use Claude Opus 5 to Hack OpenAI Forum and Reach Internal Repositories
Researchers used Claude Opus 5 to build a libheif exploit that compromised OpenAI's forum, hijacked employee ChatGPT/Codex accounts, and reached the internal monorepo.
On July 25, 2026, Hacktron researchers used Anthropic's Claude Opus 5, released the day before, to produce a working exploit for a libheif 1.19.7 heap-buffer overflow (CVE-2026-32882, DSA-6417-1) reached through HEIC/HEIF uploads that bypassed FastImage checks in OpenAI's Discourse forum, achieving RCE in about three hours after Claude Opus 4.8 failed under ASLR. A separate OpenAI SSO misconfiguration converted the compromised forum session into a no-interaction takeover of employees' ChatGPT and Codex accounts, from which researchers opened harmless pull request 1186742 in the private openai/openai monorepo to prove access. OpenAI fixed the issue roughly 14 hours after disclosure and awarded $6,500; Discourse published GHSA-vhm9-85gw-x335 on July 28.
- HEIC/HEIF uploads bypassed FastImage checks, exposing vulnerable libheif 1.19.7 to heap overflow
- Claude Opus 5 built a working ARM64 exploit in about three hours, then ported it to x86-64
- OpenAI SSO misconfiguration let a forum session take over employee ChatGPT and Codex accounts
- Researchers proved monorepo access via pull request 1186742, then disclosed through Bugcrowd
- Self-hosted Discourse operators must rebuild containers since base images stayed vulnerable
- CVEs
- CVE-2026-32882
- Victims
- OpenAI
- AI models
- Claude Opus 5Claude Opus 4.8
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-32882 | libheif is a HEIF and AVIF file format decoder and encoder | 7.1 | <1% |
From the original article
3 min read at cybersecuritynews.com
Researchers used Anthropic’s Claude Opus 5 to help weaponize an image-decoder vulnerability, compromise OpenAI’s community forum, take over employees’ ChatGPT and Codex accounts, and reach an internal source-code repository. The July 25, 2026 operation by Hacktron linked remote code execution in Discourse’s image-processing stack to a flaw in OpenAI’s single sign-on, showing how a breach […]
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.