Researchers used Claude Opus to chain a libheif RCE and SSO flaw into OpenAI's internal monorepo
A three-person Hacktron team used Claude Opus 5 to exploit a libheif heap buffer overflow in OpenAI's Discourse forum and chained it with an OpenAI SSO misconfiguration to take over employee ChatGPT/Codex accounts, proving internal monorepo access by opening…
On July 25, 2026, a three-person team at startup Hacktron AI, assisted by Anthropic's Claude Opus 4.8 and Opus 5, chained a libheif heap buffer overflow (out-of-bounds read/write during HEIC/HEIF decoding) with an OpenAI SSO identity misconfiguration to achieve remote code execution on community.openai.com, hijack an employee's ChatGPT and Codex accounts, and open pull request #1186742 in OpenAI's internal openai/openai monorepo as proof of impact. The libheif flaw was reached because Discourse routed HEIF/HEIC uploads through ImageMagick directly to the vulnerable parser, bypassing FastImage checks; Claude Opus 5 built a working ARM64 exploit in about three hours of its July 24 release after Opus 4.8 failed under ASLR (it only worked with ASLR disabled), giving RCE within roughly a day and completing the full chain inside a 72-hour attack window. The SSO flaw involved 'Sign in with OpenAI' tokens carrying excessive permissions, enabling a no-interaction takeover of accounts with connected GitHub, Slack, and email access. OpenAI narrowed token permissions and revoked sessions roughly 14 hours after the Bugcrowd disclosure and paid a $6,500 bounty, though the researchers note community.openai.com testing was excluded from bounty scope and only the OpenAI-side finding was recognized. Sources disagree on CVE assignment: Cyber Security News cites CVE-2026-32882 and Debian DSA-6417-1, while Hacker News, SecurityWeek and TechCrunch say the upstream fix — which landed about a year earlier — was never treated as a security issue and received no CVE. The work is part of Hacktron's 'HEIF Heist' research into libheif/libde265 memory-corruption flaws, which also targeted Slack, Meta, and GitHub Enterprise for under $3,000 in AI tokens over two months of testing; only Shopify detected the activity despite thousands of image uploads. Ars Technica notes the story was first reported by the Wall Street Journal, that Anthropic declined to comment and Hacktron did not respond, and that the disclosure coincided with Anthropic data showing 26% of its R&D work is led by Claude, up from 1% in March.
- Attack occurred July 25, 2026, one day after Claude Opus 5's July 24 release; the full chain from forum compromise to internal monorepo took a 72-hour window
- Entry vector: crafted HEIF/HEIC uploads triggering a libheif heap buffer overflow (out-of-bounds read/write during HEIC decoding) in Discourse's ImageMagick pipeline, bypassing FastImage checks; vulnerable versions cited as libheif…
- Claude Opus 5 produced a working ARM64 exploit in about three hours, then ported it to x86-64; Claude Opus 4.8 failed under ASLR across several sessions and only worked with ASLR disabled
- Second flaw: OpenAI SSO misconfiguration in the 'Sign in with OpenAI' flow — sign-in tokens carried excessive permissions granting full API access to ChatGPT and Codex, converting the forum compromise into a no-interaction account takeover…
- Proof of impact: pull request #1186742 opened in OpenAI's internal openai/openai monorepo from an employee's Codex account (described as harmless)
- OpenAI paid a $6,500 bounty via Bugcrowd; researchers say community.openai.com testing was excluded from bounty scope but the OpenAI-side finding was recognized
- CVE disagreement: Cyber Security News cites CVE-2026-32882 (DSA-6417-1); Hacker News, SecurityWeek and TechCrunch state the upstream libheif fix (landed roughly a year earlier) was never assigned a CVE
- Broader 'HEIF Heist' campaign targeted libheif/libde265 decoders across OpenAI, Slack, Meta, and GitHub Enterprise for under $3,000 in AI tokens over two months; only Shopify detected the activity
Coverage timelineoldest first · each row is one article
- · 16h agoA heap overflow and SSO misconfiguration to compromise OpenAI internal repos
Hacker News · security· 78
Hacktron researchers chained a libheif heap overflow in Discourse with an OpenAI SSO flaw to take over employee ChatGPT/Codex accounts and access internal repositories.
- · 14h agoResearchers Use Claude Opus 5 to Hack OpenAI Forum and Reach Internal Repositories
Cyber Security News· 70
Researchers used Claude Opus 5 to build a libheif exploit that compromised OpenAI's forum, hijacked employee ChatGPT/Codex accounts, and reached the internal monorepo.
- · 6h agoAI-Built Exploit and Sign-In Flaw Opened Path to Internal OpenAI Code
SecurityWeek· 72
Researchers chained a libheif RCE in Discourse with an over-privileged OpenAI forum sign-in token flaw to take over ChatGPT and Codex accounts.
- · 5h agoResearchers used Claude to hack OpenAI
Ars Technica · Security· 66
Researchers exploited a Discourse misconfiguration on OpenAI's community forum to reach internal sign-ons and an employee ChatGPT account with GitHub code access; OpenAI fixed it.
- · 5h agoResearchers used Anthropic’s Claude to hack into OpenAI
TechCrunch · Security· 70
Researchers used Claude Opus 5 to chain libheif and Discourse flaws, hijacking OpenAI employee ChatGPT and Codex accounts via bug bounty.
- · 3h agoSecurity researchers used Claude to help them hack into OpenAI
The Verge · AI· 66
Three Hacktron researchers used Claude Opus to breach OpenAI employee accounts through a Discourse HEIF flaw, reaching the Monorepo within 72 hours.
- · 2h agoResearchers used Claude to hack OpenAI employees' ChatGPT accounts
The Register · Security· 75
Researchers chained a libheif heap overflow with an SSO misconfiguration to take over OpenAI employee ChatGPT accounts, earning a $6,500 bounty.
- · 2h agoResearchers use AI to find widespread software decoder flaw
CyberScoop· 78
Hacktron researchers, aided by Claude and GPT-5.6 Sol, disclosed HEIF Heist, memory-corruption flaws in libheif/libde265 enabling RCE against major platforms.
- · 2h agoSecurity researchers used Anthropic's Claude to hack OpenAI's internal systems in under 72 hours
The Decoder· 76
Hacktron researchers used Claude Opus 5 to exploit libheif and an SSO flaw, taking over OpenAI employee ChatGPT and Codex accounts within 72 hours.
Vulnerabilities in this storyAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-32882 | libheif is a HEIF and AVIF file format decoder and encoder. libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and prior contain a heap buffer over-read in HeifPixelImage::overlay() in libheif/pixelimage.cc. When compositing an overlay image (iovl) whose child image has a different bit depth for the alpha channel than for the color channels, the function indexes into the alpha plane using the color channel stride (in_stride) instead of the previously retrieved alpha_stride, causing reads past the end of the alpha buffer (up to 3,123 bytes for a 100×50 image with 10-bit color and 8-bit alpha). A crafted HEIF file can exploit this to cause a denial of service (crash) or potentially disclose adjacent heap memory through leaked bytes embedded in the decoded output pixels. This issue has been fixed in versionThis issue has been fixed in version 1.22.0. NVD description · AI analysis pending | 7.1 | <1% | — | — |