AI vs. AI: How Researchers Used Claude Opus 5 to Breach OpenAI’s Internal Systems

In a sophisticated demonstration of the "double-edged sword" nature of generative artificial intelligence, a team of security researchers has revealed how they utilized one of the world’s most advanced AI models to infiltrate the internal infrastructure of OpenAI. The researchers, representing the AI-assisted security firm Hacktron, successfully chained a series of vulnerabilities to gain unauthorized access to the ChatGPT and Codex accounts of several OpenAI employees. From there, they were able to reach a private internal code repository, highlighting a critical intersection between software supply chain vulnerabilities and the rapidly evolving capabilities of Large Language Models (LLMs).

The breach was not the work of a malicious state-sponsored group or a criminal enterprise, but rather a controlled security research project. The Hacktron team reported their findings to OpenAI through the company’s bug bounty program, providing a "proof of concept" by performing a harmless pull request within the internal repository before immediately ceasing their activities. Remarkably, the transition from the initial discovery to full internal access took less than 72 hours, a timeline the researchers attribute largely to the assistance of Anthropic’s Claude Opus 5.

Why a Forum Bug Reached Staff Accounts

The entry point for the attack was not a direct assault on OpenAI’s primary AI infrastructure, but rather a vulnerability in the software powering its public community help forum. The forum runs on Discourse, a popular open-source platform used by thousands of organizations worldwide. While Discourse is generally considered secure, the researchers discovered a flaw in how the server processed specific image formats—specifically High Efficiency Image File Format (HEIF) and High Efficiency Image Coding (HEIC).

When a user uploads an image to the forum, Discourse passes the file to ImageMagick, a widely used software suite for displaying and editing bitmap files. ImageMagick, in turn, relies on a library called libheif to decode these specific image types. The researchers identified a memory corruption vulnerability within libheif that could be triggered by a specially crafted, malicious image.

However, the reason a bug in a public-facing forum could escalate into a compromise of internal employee accounts lies in OpenAI’s identity management architecture. Like many modern enterprises, OpenAI utilizes a Single Sign-On (SSO) system to streamline access across its various services. The public forum offered a "Sign in with OpenAI" option, which utilized the same underlying identity provider that employees use to access internal tools like ChatGPT, Codex, and GitHub.

By exploiting the libheif flaw to achieve Remote Code Execution (RCE) on the forum server, the Hacktron team gained control over the environment where these SSO tokens were processed. This allowed them to intercept or manipulate sessions, effectively taking over the accounts of OpenAI staff members who were active on the forum. Because the login system was shared, the researchers did not need to steal passwords or bypass multi-factor authentication (MFA) for each individual service; the initial breach of the forum’s trust boundary provided a "skeleton key" to the employees’ broader digital workspace.

Hacktron emphasized that this was primarily an OpenAI identity configuration problem rather than an inherent flaw in the Discourse software. Any first- or third-party service integrated into the same SSO umbrella could have potentially granted the same level of lateral movement.

The Technical Chain: From Memory Leaks to RCE

The vulnerability at the heart of the "HEIF Heist," as Hacktron dubbed the project, is tracked as CVE-2026-32882. While initial reports from the National Vulnerability Database (NVD) and libheif’s own advisories described the flaw as an "out-of-bounds read"—a type of bug that can crash a program or leak sensitive data from nearby memory—the researchers proved it could be far more dangerous.