Anthropic's Opus 5 Autonomously Exploited OpenAI Forum to Access Private GitHub
Security researchers demonstrated that Claude Opus 5 could independently chain vulnerabilities from an image upload through single sign-on flaws to gain access to OpenAI's internal code repositories in less than 72 hours.
Researchers at Hacktron AI leveraged Anthropic's Claude Opus 5 to combine two separate security flaws into a complete attack chain targeting OpenAI's infrastructure. The effort, which took less than 72 hours, began when the team discovered a memory-corruption vulnerability in a widely used image processing library. While identifying the bug proved straightforward, weaponizing it against a production environment presented a far greater challenge.
On July 24, the researchers handed the exploitation task to Claude Opus 4.8, which managed only limited success when memory protections remained active—the standard configuration for production systems. That same evening, Anthropic released Opus 5. When the team returned the following morning with the identical vulnerability and the new model, Opus 5 generated a functional ARM64 exploit within three hours. Four hours later, they had achieved remote code execution against a test forum instance.
By the 72-hour mark, the researchers had accessed OpenAI's private monorepo using a compromised employee Codex account, opening a pull request against a README file before halting their demonstration. Hacktron AI published details of the incident this week.
The vulnerability's origins
The underlying flaw existed not in OpenAI's own code but in Discourse, the off-the-shelf forum platform powering community.openai.com. Discourse ordinarily screens uploaded images through FastImage, but the library lacks support for HEIC and HEIF formats, routing those files instead to ImageMagick, which processes them using libheif. The version deployed in the forum's Debian 12 base image—1.19.7—contained a heap buffer overflow that specially crafted files could trigger.
A patch had been committed upstream a year earlier, but the fix was never labeled as a security issue and received no CVE assignment. This oversight prevented the patch from being backported into the Debian package the forum relied on, leaving the vulnerability exploitable despite the existence of a fix. The researchers adapted the exploit for the x86-64 and jemalloc configuration Discourse uses, demonstrating that a malformed HEIC image alone could trigger remote code execution.
Discourse later acknowledged the flaw in security advisory GHSA-vhm9-85gw-x335, assigning the upstream libheif vulnerability—designated CVE-2026-32882—a CVSS severity score of 8.8 out of 10.
Escalation through misconfigured permissions
Code execution on a forum represents a serious incident for the platform operator, but should not directly compromise the parent organization. However, the researchers uncovered a second flaw in OpenAI's single sign-on infrastructure that transformed the attack's scope. Sign-in tokens issued for the forum carried overly broad permissions, granting complete API access to linked ChatGPT and Codex accounts, some of which belonged to OpenAI staff members.
One employee's Codex account maintained a connection to OpenAI's GitHub environment, creating a pathway to the company's private repositories. According to Hacktron, additional compromised accounts could have exposed other connected services including Slack and email. The researchers deliberately ceased their demonstration after using Codex to make a harmless documentation modification to OpenAI's private openai/openai monorepo and submitting a pull request—sufficient to validate the access without causing further damage. OpenAI requested that the pull request's details be redacted.
Autonomous exploitation
To test whether human oversight remained necessary, Hacktron configured Claude in an autonomous agent loop with a defined objective and target, directing it at a Discourse instance under their control. The model independently achieved remote code execution and demonstrated the capability by reading /etc/hosts from within the container.
One tactical adjustment proved necessary: Opus initially declined to develop an exploit aimed at a live remote target. The team circumvented this restriction by proxying their own instance through rce.ee/ctf-forum, a URL that presented the target as a capture-the-flag competition.
Memory-corruption exploitation has always been specialist work, invovling memory layouts, allocators, operating system internals, and protections to make all of it wildly unreliable. Hacktron's run signals a meaningful share of that work might be able to be delegated to AI now. It also suggests the line between security research and attack development is — from the model's side, anyway — partly a question of what you consider a target.
The complete attack sequence
- HEIF image upload
- libheif buffer overflow
- Forum code execution
- Over-permissioned SSO tokens
- Employee ChatGPT/Codex account compromise
- Connected GitHub access
- Pull request in openai/openai repository
Scope and cost
The OpenAI intrusion represented one component of a larger initiative Hacktron termed "HEIF Heist," a two-month investigation spanning image-processing infrastructure across multiple major technology companies. The entire project consumed less than $3,000 in model API costs.
OpenAI awarded Hacktron a $6,500 bounty for the account-takeover vulnerability on its infrastructure. The company has since restricted permissions on community sign-in tokens and invalidated the affected tokens and sessions.