Hacktron Researchers Use Claude Opus 5 to Exploit OpenAI Forum and Login Flaws
Security firm Hacktron demonstrated how Anthropic's Claude Opus 5 helped chain a forum image-processing bug with an OpenAI single sign-on weakness to access staff accounts and an internal code repository, prompting a fix and a $6,500 bounty.
Security researchers at Hacktron employed Anthropic's Claude Opus 5 to combine two vulnerabilities and gain access to OpenAI staff accounts for ChatGPT and Codex, eventually reaching an internal code repository. The attack chain started with a memory-corruption bug in the Discourse-based public help forum, triggered by a crafted HEIC/HEIF image that exploited a libheif library flaw (CVE-2026-32882). The forum’s "Sign in with OpenAI" single sign-on (SSO) allowed the compromised forum server to impersonate staff credentials, giving the researchers control of internal accounts without any user interaction.
Hacktron reported the findings to OpenAI, demonstrated the breach with a harmless pull request, and ceased testing. OpenAI patched the login issue within about 14 hours and awarded the team a $6,500 bounty, noting the reward recognized the OpenAI-side discovery rather than the Discourse component, which was outside its bug bounty scope. OpenAI has not disclosed details of the login flaw.
The researchers highlighted that the same SSO weakness could, in theory, extend to other services linked to staff accounts, such as GitHub, Slack, and email, though no further exploitation occurred. The libheif vulnerability had been fixed upstream in May 2026, but the forum server was still running an older, unpatched version (1.19.7) supplied by Debian 12, allowing the exploit.
Claude Opus 5 generated a functional exploit within hours after its release, bypassing built-in safeguards by targeting the researchers' own test environment. The team emphasized that human guidance remained essential and the process was not fully automated. The case underscores how advanced AI models can accelerate offensive security work.
OpenAI and other organizations are advised to update libheif to the latest version, disable processing of untrusted HEIF/AVIF images where possible, and restrict SSO trust relationships, requiring fresh authentication for sensitive actions. No evidence suggests the OpenAI flaw was used in real-world attacks as of mid-September 2026.