Claude Opus 5: The AI That Helped Uncover OpenAI’s Internal Vulnerabilities

In a compelling demonstration of advanced AI’s capabilities in cybersecurity, a team of researchers from the security firm Hacktron, leveraging Anthropic’s Claude Opus 5, successfully exploited a chain of vulnerabilities to gain access to OpenAI employee accounts and an internal code repository. This wasn’t a malicious attack, but a meticulously executed security research project that underscores the evolving landscape of digital defense and offense.

The Chained Flaws: A Path to OpenAI’s Core

The intricate breach began with a seemingly innocuous bug in the open-source software, Discourse, which powers OpenAI’s public help forum. This initial foothold then paved the way through a critical weakness in OpenAI’s own single sign-on (SSO) login system. Hacktron’s researchers managed to achieve internal access in under 72 hours, a testament to the efficiency of their methods, particularly with AI assistance.

From Forum Bug to Staff Accounts

The core of the vulnerability chain lay not just in the forum software, but in how it integrated with OpenAI’s broader identity management. The forum’s ‘Sign in with OpenAI’ option, identical to the SSO used by staff, became the critical bridge. Once the researchers controlled the forum server, this shared login mechanism allowed them to commandeer ChatGPT and Codex accounts belonging to OpenAI employees who were also forum members. Crucially, the victims did not need to take any action, highlighting a fundamental identity problem within OpenAI’s system rather than a flaw in Discourse itself.

The Image Bug: A Technical Deep Dive

The initial entry point into the Discourse forum was an image processing vulnerability. Discourse handles uploaded HEIC and HEIF images via ImageMagick, which in turn uses the libheif library. A specially crafted image exploited a flaw in libheif (tracked as CVE-2026-32882), leading to memory corruption on the forum server. While public advisories for CVE-2026-32882 described it as an out-of-bounds read, Hacktron’s team, with AI’s aid, escalated this into full remote code execution (RCE). Despite a fix for libheif 1.22.0 being available months prior (May 2026), the forum’s Debian 12-based server was still running an unpatched version (1.19.7) when the research took place in July.

Claude Opus 5: The AI Accelerator

Perhaps the most striking aspect of this research was the pivotal role played by Anthropic’s Claude Opus 5. Initially, Claude Opus 4.8 struggled to generate a working exploit against standard memory defenses like ASLR. However, upon the release of Claude Opus 5 on July 24, the new model, in a fresh session, produced a functional exploit within mere hours. The researchers bypassed Opus 5’s built-in safeguards by directing it towards a disguised test server, allowing it to operate in an automated loop. This experience underscores a significant shift: while human expertise remains crucial, advanced AI models are dramatically reducing the time and specialized skill required for sophisticated offensive security operations.

Ethical Disclosure and Broader Implications

Hacktron acted as a responsible security firm, reporting the flaws to OpenAI, proving access with a harmless pull request, and then ceasing their activities. OpenAI confirmed the fix within 14 hours and awarded Hacktron a $6,500 bounty, acknowledging the OpenAI-side finding. While the immediate impact was contained, the potential reach was far greater. Given that OpenAI staff connect other services to ChatGPT and Codex, the same access could theoretically have extended to critical platforms like GitHub, Slack, and email.

This incident serves as a stark reminder of the increasing sophistication in cybersecurity. As AI models like Claude Opus 5 become more capable, their dual potential for both defense and offense grows. Anthropic itself has reported that criminal and state-backed groups are already leveraging its models for real intrusions, signaling a new era where AI is not just a tool, but a formidable force in the ongoing battle for digital security.

For more details, visit our website.

Source: Link