Claude Opus 5 Chained 2 Flaws to Breach OpenAI Staff Accounts

Executive Summary

In a landmark demonstration of autonomous artificial intelligence accelerating offensive cyber operations, security researchers at Hacktron have revealed how they utilized Anthropic's Claude Opus 5 model to chain two vulnerabilities together: achieving remote code execution (RCE) on OpenAI's public community forum and executing a zero-interaction account takeover of multiple OpenAI employees. The compromised accounts granted the researchers access to employee ChatGPT and Codex environments, which were subsequently used to demonstrate unauthorized access to OpenAI's internal GitHub repository (openai/openai).

The intrusion chain began with an unpatched heap buffer overflow in `libheif` (tracked under Discourse advisory CVE-2026-32882 / GHSA-vhm9-85gw-x335), an image parsing library invoked by ImageMagick on OpenAI's Discourse forum (community.openai.com). To operationalize the memory corruption flaw against modern Address Space Layout Randomization (ASLR) and jemalloc heap defenses, the researchers deployed Claude Opus 5 in an automated loop. Within hours of the model's release, Opus 5 synthesized working exploit primitives and achieved remote code execution.

Once inside the forum host, the researchers leveraged a critical architectural vulnerability in OpenAI's Single Sign-On (SSO) infrastructure (auth.openai.com). Because the community forum shared an identity trust boundary with OpenAI's corporate developer tooling, compromising the forum allowed the researchers to hijack the sessions of OpenAI personnel who had logged into the board. The entire progression from reconnaissance to internal repository pull request was completed in under 72 hours. OpenAI patched the identity flaw within 14 hours of notification and awarded a $6,500 bounty recognizing the OpenAI-side identity finding.

Technical Vulnerability Analysis & Attack Chain

The exploit chain coupled a low-level memory safety failure in an open-source media parser with an enterprise identity federation misconfiguration:

[Attacker Crafts Malicious HEIC/HEIF Image Payload]

│

▼

[Discourse Forum Upload Pipeline (community.openai.com)]

- FastImage Fails on HEIF -> Invokes ImageMagick 'magick' CLI

- Debian 12 Docker Image Ships Outdated libheif 1.19.7

│

▼

[libheif Heap Buffer Overflow & ASLR Bypass (CVE-2026-32882)]

- Unpatched Overlay Area Computation -> Out-of-Bounds Read/Write

- Claude Opus 5 Synthesizes jemalloc x86-64 Memory Exploitation Loop

- Remote Code Execution (RCE) on Discourse Forum Server

│

▼

[OpenAI SSO Identity Architecture Abuse (auth.openai.com)]

- Forum Shares "Sign in with OpenAI" Single Sign-On Identity Flow

- Zero-Interaction Account Takeover of Logged-In OpenAI Staff

│

▼

[Privilege Traversal to ChatGPT & Codex Accounts]

- Hijacks Active Staff Identity Tokens & Tool Connectors

- Accesses OpenAI Internal Developer Infrastructure

│

▼

[OpenAI Monorepo Access on GitHub (openai/openai)]

- Codex Prompted to Issue Harmless PoC Pull Request #1186742

- Full Proof of Concept Achieved Without Data Exfiltration

1. The Entry Vector: Discourse, ImageMagick, and libheif (CVE-2026-32882)

The entry point targeted the media upload pipeline on community.openai.com, which runs on the open-source Discourse forum software:

• Parser Routing: Discourse typically uses the lightweight FastImage gem to validate image dimensions and metadata. However, because FastImage lacked native support for High Efficiency Image Container (.heic / .heif) formats, Discourse routed these files to ImageMagick's command-line utility (magick), which in turn called the shared system library libheif.
• Missing Backports: Although the upstream libheif project had resolved an integer overflow and heap buffer overflow in overlay overlap area computations months earlier, the commit was not flagged as a security advisory and received no upstream CVE at the time. As a result, Linux distributions including Debian 12 (bookworm)—the base image for standard Discourse Docker deployments—continued shipping vulnerable libheif packages (version 1.19.7).
• Memory Corruption: By uploading an engineered HEIC image, the researchers triggered an out-of-bounds heap buffer overflow, providing preliminary read and write primitives.

2. Autonomous Exploit Synthesis via Claude Opus 5

Weaponizing heap corruption against hardened Linux servers protected by ASLR and the jemalloc memory allocator historically requires extensive manual debugging and reverse engineering:

• Model Evolution: The researchers initially tasked Claude Opus 4.8 with generating the exploit. While it produced a working script with ASLR disabled, it repeatedly failed to achieve reliable execution under ASLR.
• Opus 5 Deployment: On the evening of July 24, 2026, Anthropic released Claude Opus 5. The researchers initiated a fresh session, framing the debugging task as a capture-the-flag (CTF) challenge behind a proxy (rce.ee/ctf-forum) to navigate safety constraints.
• Autonomous Convergence: Within three hours, Opus 5 generated a functional local ARM64 exploit, subsequently porting it to the target's x86-64 jemalloc architecture. Configured in an autonomous /goal loop, the model iterated through heap layout offsets, leaked base memory addresses to bypass ASLR, and successfully established shell access on the cloud Discourse instance by reading /etc/hosts.

3. Identity Federation Abuse: From Forum to OpenAI Core Repos

With administrative and system-level execution achieved on the Discourse container, the researchers pivoted to OpenAI's identity plane:

• Shared SSO Flaw: The community forum utilized "Sign in with OpenAI" powered by auth.openai.com. Because the identity tokens and session validation mechanisms did not enforce cryptographic separation between third-party community services and internal employee accounts, controlling the forum server allowed the researchers to intercept, forge, or hijack session credentials for any forum participant.
• Staff Account Takeover: Multiple OpenAI engineers and researchers actively participated in the community forum using their corporate credentials. The identity flaw permitted zero-interaction account takeovers of these employees' ChatGPT and Codex profiles.
• Internal Monorepo Access: Because OpenAI personnel connected internal developer extensions to Codex and ChatGPT, compromising the employee's Codex profile provided immediate programmatic access to OpenAI's internal GitHub monorepo (openai/openai). To prove access without inspecting source code or exfiltrating proprietary data, the researchers prompted Codex to submit Pull Request #1186742, after which all offensive operations were halted.

Threat Actor Profile & Campaign Attribution

• Research Attribution: The research was conducted ethically by Harsh Jaiswal, Mohan Pedhapati, and Rahul Maini of security firm Hacktron, operating under responsible disclosure guidelines.
• The "HEIF Heist" Initiative: Hacktron revealed that the Discourse attack was part of a broader, multi-month research effort dubbed HEIF Heist. By analyzing libheif integrations across enterprise software, the team discovered identical image-decoding attack vectors impacting major platforms including Slack, Meta, GitHub Enterprise, and web frameworks such as Next.js, Astro, and Gatsby.
• Economics of AI Exploitation: The researchers disclosed that the entire two-month HEIF Heist campaign cost less than $3,000 in total AI API tokens. Complex binary exploitation, heap manipulation, and cross-architecture shellcode development—once the exclusive domain of state-sponsored offensive units or elite exploit brokers—have been democratized into inexpensive, commodity compute tasks.

Detection & SOC Mitigation Playbook

1. Patch & Workaround Guidance

• Discourse Forum Deployments:
  • Rebuild self-hosted Discourse containers immediately to pull updated base images containing patched libheif libraries:

cd /var/discourse

git pull

./launcher rebuild app

• Verify that the underlying host or container runs libheif >= 1.23.4 or verified distribution backports (Debian DSA-6417-1).

• Decouple Public Single Sign-On Realms:
  • Strictly isolate corporate SSO token scopes. Public or third-party community platforms must never accept or issue authentication tokens with cross-service privileges valid on core enterprise developer tools (GitHub, Slack, CI/CD, Codex).

2. Network & Perimeter Defenses

• Harden ImageMagick Security Policy:
  • Restrict ImageMagick from processing complex vector or containerized image formats if not strictly required:

<!-- /etc/ImageMagick-7/policy.xml -->

<policymap>

<policy domain="coder" rights="none" pattern="HEIC" />

<policy domain="coder" rights="none" pattern="HEIF" />

<policy domain="coder" rights="none" pattern="AVIF" />

</policymap>

• Isolate Media Decoding in Micro-Sandboxes:
  • Run image transformation and file parsing tasks inside ephemeral, unprivileged microVMs or sandboxes (e.g., gVisor, Firecracker, or Docker with restrictive seccomp and dropped capabilities) with all outbound network connectivity blocked.

3. Endpoint Detection & Hunting Query

Sigma Rule: ImageMagick Spawning Interactive Shell or Remote Network Process

title: ImageMagick Utility Spawning Unexpected Child Process

status: experimental

description: Detects unusual shell or utility processes spawned by ImageMagick (magick) or Discourse Puma web workers, indicating exploitation of image parsing libraries like libheif.

logsource:

category: process_creation

product: linux

detection:

selection:

ParentImage|endswith:

- '/magick'

- '/convert'

- '/puma'

Image|endswith:

- '/bin/sh'

- '/bin/bash'

- '/usr/bin/curl'

- '/usr/bin/wget'

- '/usr/bin/python3'

- '/usr/bin/nc'

condition: selection

level: critical

tags:

- attack.execution

- attack.t1059.004

- attack.initial_access

- attack.t1190

Splunk Hunting Query: Outbound Connections from Forum Containers

index=network sourcetype=container_traffic app="discourse"

| where dest_port IN (4444, 1337, 8080, 9001) OR (dest_port=443 AND NOT cidrmatch("104.16.0.0/12", dest_ip))

| stats count earliest(_time) as first_seen latest(_time) as last_seen by container_name, src_ip, dest_ip, dest_port

| convert ctime(first_seen) ctime(last_seen)

| sort - count