Full Report
Three researchers at the security firm Hacktron used Anthropic's Claude Opus 5 to chain two flaws and take over the ChatGPT and Codex accounts of several OpenAI employees, then reach an internal OpenAI code repository. The chain began with a bug in the software that runs OpenAI's public help forum and moved through a weakness in OpenAI's own login system. This was security research,
Analysis Summary
# Incident Report: OpenAI Internal Access via Chained Vulnerabilities
## Executive Summary
Security researchers from Hacktron successfully compromised OpenAI employee accounts and reached internal code repositories by chaining a remote code execution (RCE) flaw in OpenAI's public help forum with a weakness in their Single Sign-On (SSO) system. The attack, facilitated by Claude Opus 5, demonstrated that vulnerabilities in peripheral services can lead to full compromise of highly sensitive internal environments. The researchers responsibly disclosed the findings, resulting in a $6,500 bug bounty and immediate remediation by OpenAI.
## Incident Details
- **Discovery Date:** July 2026
- **Incident Date:** July 24–27, 2026
- **Affected Organization:** OpenAI
- **Sector:** Artificial Intelligence / Technology
- **Geography:** United States
## Timeline of Events
### Initial Access
- **Date/Time:** July 24, 2026 (Evening)
- **Vector:** Exploitation of CVE-2026-32882 in Discourse (Help Forum)
- **Details:** Researchers utilized Claude Opus 5 to generate a working exploit for an out-of-bounds read/memory corruption flaw in `libheif` (version 1.19.7) used by the forum's ImageMagick implementation.
### Lateral Movement
- **Mechanism:** SSO Session Hijacking / Identity Flaw.
- **Details:** By controlling the forum server, researchers leveraged the "Sign in with OpenAI" SSO mechanism. Since OpenAI employees used the same identity provider for the forum as they did for internal tools, the researchers were able to pivot from the forum session to the employees' ChatGPT and Codex accounts without user interaction.
### Data Exfiltration/Impact
- **Scope:** Access to internal OpenAI code repositories via Codex.
- **Action:** A harmless pull request was triggered to prove access.
- **Potential Reach:** The researchers noted that the access could have theoretically extended to Slack, GitHub, and email due to integrated service permissions, though these were not accessed.
### Detection & Response
- **Discovery:** Reported by Hacktron researchers via OpenAI’s bug bounty program.
- **Response Actions:** OpenAI patched the login flaw approximately 14 hours after the report. A $6,500 bounty was paid on September 1, 2026.
## Attack Methodology
- **Initial Access:** Remote Code Execution (RCE) via malicious HEIC/HEIF image upload.
- **Persistence:** Not maintained (Security Research).
- **Privilege Escalation:** Chained memory corruption to bypass ASLR; exploited SSO trust relationship.
- **Defense Evasion:** Used AI (Claude Opus 5) to develop a sophisticated exploit that bypassed standard memory protections.
- **Credential Access:** Session hijacking via shared SSO identity provider.
- **Discovery:** Probing the relationship between public-facing forum accounts and internal employee identities.
- **Lateral Movement:** Pivot from public forum server to internal OpenAI environment via Codex/SSO.
- **Collection:** N/A (Researchers intentionally avoided reading source code).
- **Exfiltration:** N/A (Proof-of-concept pull request only).
- **Impact:** Demonstrable unauthorized access to internal development environments.
## Impact Assessment
- **Financial:** $6,500 (Bug bounty payout).
- **Data Breach:** Limited to a proof-of-concept pull request; no customer data or source code was stolen.
- **Operational:** None (Authorized research).
- **Reputational:** High potential risk, highlighting the vulnerability of AI developers to AI-assisted attacks.
## Indicators of Compromise
- **Network:** Unexpected outbound connections from the Discourse forum server to internal OpenAI endpoints.
- **File:** Malicious HEIC/HEIF files triggering ImageMagick/libheif crashes.
- **Behavioral:** Single Sign-On (SSO) tokens generated from the forum server IP address being used to access internal Codex/ChatGPT accounts.
## Response Actions
- **Containment:** Rapid patching of the OpenAI-side login flaw within 14 hours.
- **Eradication:** Updating the Discourse server environment to include patched versions of `libheif` (1.22.0 or higher).
- **Recovery:** Verification of account security and audit of internal repository logs.
## Lessons Learned
- **AI-Augmented Exploitation:** The jump in capability from Claude 4.8 to 5.0 allowed for the rapid development of complex exploits (bypassing ASLR) that were previously difficult for LLMs.
- **Supply Chain/Dependency Management:** The forum was vulnerable because the underlying Debian 12 image contained an unpatched library, even though a fix was publicly available months prior.
- **SSO Blast Radius:** Using a single identity provider for both public-facing community tools and sensitive internal repositories creates a critical point of failure.
## Recommendations
- **Identity Isolation:** Separate SSO environments for public community platforms and internal corporate/development resources.
- **Patch Management:** Implement automated container/image scanning to identify outdated libraries (like `libheif`) even when the top-level application (Discourse) appears updated.
- **Hardening:** Disable support for unnecessary image formats in ImageMagick (e.g., HEIC/HEIF) if not required for business operations.