Claude Opus 5 Helped Researchers Take Over OpenAI Staff Accounts via Chained Flaws
Hacktron researchers used Claude Opus 5 to chain a libheif flaw and OpenAI SSO weakness, taking over staff ChatGPT and Codex accounts; OpenAI paid $6,500.
Three Hacktron researchers chained CVE-2026-32882, a libheif out-of-bounds read weaponized into remote code execution on self-hosted Discourse forum servers, with an OpenAI single sign-on design weakness to hijack employee ChatGPT and Codex accounts, reaching an internal code repository in under 72 hours. They proved access with one harmless pull request, read no source code, and OpenAI shipped a fix about 14 hours after the report, paying a $6,500 bounty on September 1. Claude Opus 5, released July 24, produced a working ASLR-defeating exploit within hours after Claude Opus 4.8 had failed across multiple sessions; the researchers bypassed its safeguards by framing the target as a capture-the-flag server. Discourse urged self-hosters to rebuild images on fixed releases (2026.7.0, 2026.6.1, 2026.5.2, 2026.1.6), noting Debian 12 images still shipped unpatched libheif 1.19.7 despite the upstream fix in libheif 1.22.0 in May 2026.
- CVE-2026-32882 is an out-of-bounds read in libheif enabling memory leaks, ASLR defeat, and weaponized code execution on Discourse servers.
- OpenAI SSO shared between the public forum and staff services let forum server compromise grant ChatGPT and Codex account takeover.
- Claude Opus 5 built a working exploit within hours; Claude Opus 4.8 failed against ASLR over several sessions.
- OpenAI fixed within about 14 hours and paid a $6,500 bounty; no source code was read and no customer data touched.
- Wider HEIF Heist campaign reportedly hit image pipelines at other firms including Shopify, costing under $3,000 in AI usage.
- CVEs
- CVE-2026-32882
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-32882 | libheif is a HEIF and AVIF file format decoder and encoder | 7.1 | <1% |
From the original article
5 min read at thehackernews.com
Three researchers at the security firm Hacktron used Anthropic's Claude Opus 5 to chain two flaws and take over the ChatGPT and Codex accounts of several OpenAI employees, then reach an internal OpenAI code repository. The chain began with a bug in the software that runs OpenAI's public help forum and moved through a weakness in OpenAI's own login system. This was security research,
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.