AI vs. AI: How Researchers Used Claude Opus 5 to Breach OpenAI’s Internal Systems

In a statement regarding the payout, OpenAI clarified that the award was specifically for the "OpenAI-side finding"—the identity and login system weakness—rather than the vulnerability in Discourse itself. The company noted that testing the open-source forum software was technically outside the scope of its primary bug bounty program, but the severity of the resulting account takeovers warranted the payment.

OpenAI has not publicly detailed the specific mechanics of the login flaw, choosing instead to confirm the resolution through the bounty payment and the implementation of the fix. For its part, Hacktron was careful to limit the scope of its intrusion. Upon gaining access to the internal GitHub repository via an employee’s Codex link, they triggered only a single, harmless pull request. They did not read proprietary source code, merge any changes into production, or access any customer data.

However, the researchers warned that the potential impact could have been catastrophic. Because employees often connect various productivity services to their ChatGPT and Codex accounts, the same SSO access could, in theory, have allowed the team to pivot into Slack channels, internal emails, and more sensitive areas of the GitHub environment.

What to Do

The "HEIF Heist" serves as a stark reminder of the risks inherent in the modern software supply chain and the dangers of "trust transitivity" in SSO environments.

For administrators of Discourse servers, the lesson is immediate: the vulnerability in libheif was actually patched in version 1.22.0 in May 2026, months before Hacktron’s research. However, because the forum’s server image was built on Debian 12, it continued to ship with an older, unpatched version of the library (1.19.7). This "packaging lag" is a common issue in the Linux ecosystem, where stability is often prioritized over the rapid adoption of new upstream versions.

Discourse has since released several patched versions (2026.7.0, 2026.6.1, 2026.5.2, and 2026.1.6). Organizations running self-hosted instances of Discourse are urged to rebuild their server images to ensure the underlying system libraries, not just the web application, are up to date. Sites hosted directly by Discourse were patched automatically and were not at risk during the researchers’ testing.

The broader takeaway for the cybersecurity industry is the need to re-evaluate the security of public-facing assets that share identity providers with internal systems. When a "low-trust" environment like a community forum is allowed to generate tokens that are valid for "high-trust" environments like source code repositories, the security of the entire organization is only as strong as the forum’s image-processing library.

As of mid-September 2026, there is no evidence that this specific exploit chain has been used by malicious actors in the wild. It does not appear on the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) list of known exploited vulnerabilities. However, as AI models like Claude Opus 5 and GPT-5.6 Sol continue to lower the barrier to entry for sophisticated exploit development, the window between the disclosure of a bug and its automated exploitation is likely to continue shrinking.