Three researchers at the security firm **Hacktron**, specializing in AI-assisted security research, recently demonstrated a sophisticated exploit chain against **OpenAI**. Utilizing **Anthropic's Claude Opus 5**, they successfully combined two distinct flaws to take control of **ChatGPT** and **Codex** accounts belonging to several **OpenAI** employees, ultimately reaching an internal **OpenAI** code repository. This was a controlled security research effort, not a malicious attack. The team promptly reported their findings to **OpenAI**, providing proof of access with a harmless pull request before ceasing their activities. The initial internal access was achieved in under 72 hours. **OpenAI** confirmed the fix approximately 14 hours after the report and awarded **Hacktron** a $6,500 bounty on September 1. **OpenAI** clarified that the award recognized the internal finding, not the actions against **Discourse**, the open-source software powering the forum, as testing the forum itself fell outside its bug bounty program. While **OpenAI** has not publicly detailed the login flaw, the fix and payment served as confirmation of the finding. **Hacktron** meticulously avoided accessing sensitive data, reading source code, or merging any changes within the repository. Their interaction was limited to triggering a single pull request. The potential scope of the breach was significantly wider. Due to staff connecting other services to **ChatGPT** and **Codex**, the same access could theoretically have extended to platforms like **GitHub**, **Slack**, and email, though this was not exploited. ### Why a Forum Bug Reached Staff Accounts The vulnerability's ability to escalate from a public forum to staff accounts stemmed from **OpenAI's** shared login system. The **OpenAI** forum offers a "Sign in with **OpenAI**" option, which is the same Single Sign-On (SSO) used by employees for internal tools. Once the researchers compromised the forum server, this shared login allowed them to take over **ChatGPT** and **Codex** accounts of forum members who also worked at **OpenAI**, requiring no action from the victims. As **Hacktron** highlighted on their blog, this was an **OpenAI** identity problem, not a flaw in the **Discourse** software itself. Any first- or third-party service using the same SSO could have granted similar access.  The initial point of entry was an image bug. The **Discourse** forum processes uploaded **HEIC** and **HEIF** images via **ImageMagick**, which in turn uses the **libheif** library. A flaw within **libheif** allowed a specially crafted image to corrupt the forum server's memory. **Discourse's** advisory rates this issue as remote code execution, scoring it 8.8 out of 10, and tracks it as **CVE-2026-32882**. While public records for **CVE-2026-32882** in **libheif's** own advisory and national vulnerability databases describe it as an out-of-bounds read leading to crashes or memory leaks, **Hacktron** researchers, with AI assistance, combined these memory bugs to achieve working code execution on the forum server, circumventing protections like **ASLR**. The fix for this flaw was released in **libheif 1.22.0** in May 2026, months before the research. However, the forum's server image, based on the **Debian 12** Linux distribution, was still running the unpatched **libheif** version 1.19.7 when the researchers conducted their tests in July. The fix had not yet been incorporated into **Debian's** packaged version. For organizations running their own **Discourse** servers, this is a direct call to action: rebuild on the latest image to ensure the patched **libheif** is installed, as a web-interface update alone may not replace the old library. **Discourse**-hosted sites were already patched, and fixed self-hosted releases include 2026.7.0, 2026.6.1, 2026.5.2, and 2026.1.6. ### How the Researchers Used AI The researchers heavily relied on AI to overcome complex exploit development challenges. Initially, **Claude Opus 4.8** struggled to produce a working exploit against **ASLR**-enabled systems across multiple sessions. However, upon the release of **Anthropic's Claude Opus 5** on July 24, a fresh session with the new model generated a functional exploit within hours. **Opus 5** includes safeguards designed to prevent the generation of exploit code for real targets. The researchers bypassed these by directing the model toward their own test server, disguised as a capture-the-flag target, and running it in an automated loop. They emphasize that human expertise remained crucial, underscoring that this was not fully automated, hands-off hacking.  This case exemplifies a trend observed by researchers and AI companies: capable AI models are drastically reducing the time and skill required for serious offensive security work. **Anthropic** has reported that criminal and state-backed groups are already utilizing its **Claude** models for real intrusions, not just for informational queries. The **OpenAI** exploit was part of a broader **Hacktron** project dubbed **HEIF Heist**. Over approximately two months, the team claims to have discovered similar image-decoding flaws in software used by other major companies, at a total AI usage cost of under $3,000. This campaign is linked to reported bugs in **Slack**, **Meta's** products, **GitHub Enterprise**, and web frameworks like **Next.js**. These broader claims have received uneven independent confirmation. The **Next.js** flaw is confirmed in **Vercel's** advisory, and **libheif's** maintainers have confirmed a working code-execution exploit for the bug associated with **Meta**. However, the wider assertion of code execution across many applications has not been independently verified, a point noted by **The Hacker News** when it first covered the **Next.js** flaw in August. The broader **HEIF Heist** campaign leveraged **OpenAI's** own **GPT-5.6 Sol** model for targets where prior knowledge was limited. Interestingly, only **Shopify** reportedly detected activity, despite its image processors crashing repeatedly under thousands of test uploads. ### What to Do The lessons from this research extend beyond **Discourse**. If your service accepts user-uploaded images and processes **HEIC**, **HEIF**, or **AVIF** files through **libheif**, an outdated build could leave you vulnerable. Furthermore, if a public, lower-trust service shares your Single Sign-On with internal tools, a compromise of that external service can lead to a widespread breach across all linked internal systems. * **Update libheif** to the latest security release (**1.23.4** as of early September 2026) or to your distribution's patched build. * Where not essential, **disable decoding of untrusted HEIF and AVIF images**, or process image uploads within a strictly isolated sandbox environment. * **Limit the services your Single Sign-On trusts**, and implement requirements for a fresh identity check before sensitive actions, rather than solely relying on an existing session. There is no indication that the **OpenAI** flaw was exploited in the real world. As of mid-September 2026, it was not listed on the U.S. government's catalog of known exploited vulnerabilities, though this list is not exhaustive.