ZeroHour
Story · 9 sources · 9 articlesfirst updated ()1

Researchers used Claude Opus to chain a libheif RCE and SSO flaw into OpenAI's internal monorepo

highResearchexploited in the wildimportance 78CVE-2026-32882
What's new: OpenAI fixed the SSO issue roughly 14 hours after disclosure by narrowing sign-in token permissions and revoking sessions; OpenAI says both issues are now resolved (fixed ~July 25-26, 2026)
Merged summary · glm-5.3-flash · rewritten as coverage arrives

A three-person Hacktron team used Claude Opus 5 to exploit a libheif heap buffer overflow in OpenAI's Discourse forum and chained it with an OpenAI SSO misconfiguration to take over employee ChatGPT/Codex accounts, proving internal monorepo access by opening…

On July 25, 2026, a three-person team at startup Hacktron AI, assisted by Anthropic's Claude Opus 4.8 and Opus 5, chained a libheif heap buffer overflow (out-of-bounds read/write during HEIC/HEIF decoding) with an OpenAI SSO identity misconfiguration to achieve remote code execution on community.openai.com, hijack an employee's ChatGPT and Codex accounts, and open pull request #1186742 in OpenAI's internal openai/openai monorepo as proof of impact. The libheif flaw was reached because Discourse routed HEIF/HEIC uploads through ImageMagick directly to the vulnerable parser, bypassing FastImage checks; Claude Opus 5 built a working ARM64 exploit in about three hours of its July 24 release after Opus 4.8 failed under ASLR (it only worked with ASLR disabled), giving RCE within roughly a day and completing the full chain inside a 72-hour attack window. The SSO flaw involved 'Sign in with OpenAI' tokens carrying excessive permissions, enabling a no-interaction takeover of accounts with connected GitHub, Slack, and email access. OpenAI narrowed token permissions and revoked sessions roughly 14 hours after the Bugcrowd disclosure and paid a $6,500 bounty, though the researchers note community.openai.com testing was excluded from bounty scope and only the OpenAI-side finding was recognized. Sources disagree on CVE assignment: Cyber Security News cites CVE-2026-32882 and Debian DSA-6417-1, while Hacker News, SecurityWeek and TechCrunch say the upstream fix — which landed about a year earlier — was never treated as a security issue and received no CVE. The work is part of Hacktron's 'HEIF Heist' research into libheif/libde265 memory-corruption flaws, which also targeted Slack, Meta, and GitHub Enterprise for under $3,000 in AI tokens over two months of testing; only Shopify detected the activity despite thousands of image uploads. Ars Technica notes the story was first reported by the Wall Street Journal, that Anthropic declined to comment and Hacktron did not respond, and that the disclosure coincided with Anthropic data showing 26% of its R&D work is led by Claude, up from 1% in March.

  • Attack occurred July 25, 2026, one day after Claude Opus 5's July 24 release; the full chain from forum compromise to internal monorepo took a 72-hour window
  • Entry vector: crafted HEIF/HEIC uploads triggering a libheif heap buffer overflow (out-of-bounds read/write during HEIC decoding) in Discourse's ImageMagick pipeline, bypassing FastImage checks; vulnerable versions cited as libheif…
  • Claude Opus 5 produced a working ARM64 exploit in about three hours, then ported it to x86-64; Claude Opus 4.8 failed under ASLR across several sessions and only worked with ASLR disabled
  • Second flaw: OpenAI SSO misconfiguration in the 'Sign in with OpenAI' flow — sign-in tokens carried excessive permissions granting full API access to ChatGPT and Codex, converting the forum compromise into a no-interaction account takeover…
  • Proof of impact: pull request #1186742 opened in OpenAI's internal openai/openai monorepo from an employee's Codex account (described as harmless)
  • OpenAI paid a $6,500 bounty via Bugcrowd; researchers say community.openai.com testing was excluded from bounty scope but the OpenAI-side finding was recognized
  • CVE disagreement: Cyber Security News cites CVE-2026-32882 (DSA-6417-1); Hacker News, SecurityWeek and TechCrunch state the upstream libheif fix (landed roughly a year earlier) was never assigned a CVE
  • Broader 'HEIF Heist' campaign targeted libheif/libde265 decoders across OpenAI, Slack, Meta, and GitHub Enterprise for under $3,000 in AI tokens over two months; only Shopify detected the activity

Coverage timeline

  1. · 16h ago
    Hacker News · security· 78
    A heap overflow and SSO misconfiguration to compromise OpenAI internal repos

    Hacktron researchers chained a libheif heap overflow in Discourse with an OpenAI SSO flaw to take over employee ChatGPT/Codex accounts and access internal repositories.

  2. · 14h ago
    Cyber Security News· 70
    Researchers Use Claude Opus 5 to Hack OpenAI Forum and Reach Internal Repositories

    Researchers used Claude Opus 5 to build a libheif exploit that compromised OpenAI's forum, hijacked employee ChatGPT/Codex accounts, and reached the internal monorepo.

  3. · 6h ago
    SecurityWeek· 72
    AI-Built Exploit and Sign-In Flaw Opened Path to Internal OpenAI Code

    Researchers chained a libheif RCE in Discourse with an over-privileged OpenAI forum sign-in token flaw to take over ChatGPT and Codex accounts.

  4. · 5h ago
    Ars Technica · Security· 66
    Researchers used Claude to hack OpenAI

    Researchers exploited a Discourse misconfiguration on OpenAI's community forum to reach internal sign-ons and an employee ChatGPT account with GitHub code access; OpenAI fixed it.

  5. · 5h ago
    TechCrunch · Security· 70
    Researchers used Anthropic’s Claude to hack into OpenAI

    Researchers used Claude Opus 5 to chain libheif and Discourse flaws, hijacking OpenAI employee ChatGPT and Codex accounts via bug bounty.

  6. · 3h ago
    The Verge · AI· 66
    Security researchers used Claude to help them hack into OpenAI

    Three Hacktron researchers used Claude Opus to breach OpenAI employee accounts through a Discourse HEIF flaw, reaching the Monorepo within 72 hours.

  7. · 2h ago
    The Register · Security· 75
    Researchers used Claude to hack OpenAI employees' ChatGPT accounts

    Researchers chained a libheif heap overflow with an SSO misconfiguration to take over OpenAI employee ChatGPT accounts, earning a $6,500 bounty.

  8. · 2h ago
    CyberScoop· 78
    Researchers use AI to find widespread software decoder flaw

    Hacktron researchers, aided by Claude and GPT-5.6 Sol, disclosed HEIF Heist, memory-corruption flaws in libheif/libde265 enabling RCE against major platforms.

  9. · 2h ago
    The Decoder· 76
    Security researchers used Anthropic's Claude to hack OpenAI's internal systems in under 72 hours

    Hacktron researchers used Claude Opus 5 to exploit libheif and an SSO flaw, taking over OpenAI employee ChatGPT and Codex accounts within 72 hours.

Vulnerabilities in this storyAll →

CVEVulnerabilityCVSSEPSSFlagsAffectedExposurePublished
CVE-2026-32882
libheif is a HEIF and AVIF file format decoder and encoder.

libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and prior contain a heap buffer over-read in HeifPixelImage::overlay() in libheif/pixelimage.cc. When compositing an overlay image (iovl) whose child image has a different bit depth for the alpha channel than for the color channels, the function indexes into the alpha plane using the color channel stride (in_stride) instead of the previously retrieved alpha_stride, causing reads past the end of the alpha buffer (up to 3,123 bytes for a 100×50 image with 10-bit color and 8-bit alpha). A crafted HEIF file can exploit this to cause a denial of service (crash) or potentially disclose adjacent heap memory through leaked bytes embedded in the decoded output pixels. This issue has been fixed in versionThis issue has been fixed in version 1.22.0.

NVD description · AI analysis pending
7.1<1%