AI vs. AI: How Researchers Used Claude Opus 5 to Breach OpenAI’s Internal Systems

In a sophisticated demonstration of the "double-edged sword" nature of generative artificial intelligence, a team of security researchers has revealed how they utilized one of the world’s most advanced AI models to infiltrate the internal infrastructure of OpenAI. The researchers, representing the AI-assisted security firm Hacktron, successfully chained a series of vulnerabilities to gain unauthorized access to the ChatGPT and Codex accounts of several OpenAI employees. From there, they were able to reach a private internal code repository, highlighting a critical intersection between software supply chain vulnerabilities and the rapidly evolving capabilities of Large Language Models (LLMs).

The breach was not the work of a malicious state-sponsored group or a criminal enterprise, but rather a controlled security research project. The Hacktron team reported their findings to OpenAI through the company’s bug bounty program, providing a "proof of concept" by performing a harmless pull request within the internal repository before immediately ceasing their activities. Remarkably, the transition from the initial discovery to full internal access took less than 72 hours, a timeline the researchers attribute largely to the assistance of Anthropic’s Claude Opus 5.

Why a Forum Bug Reached Staff Accounts

The entry point for the attack was not a direct assault on OpenAI’s primary AI infrastructure, but rather a vulnerability in the software powering its public community help forum. The forum runs on Discourse, a popular open-source platform used by thousands of organizations worldwide. While Discourse is generally considered secure, the researchers discovered a flaw in how the server processed specific image formats—specifically High Efficiency Image File Format (HEIF) and High Efficiency Image Coding (HEIC).

When a user uploads an image to the forum, Discourse passes the file to ImageMagick, a widely used software suite for displaying and editing bitmap files. ImageMagick, in turn, relies on a library called libheif to decode these specific image types. The researchers identified a memory corruption vulnerability within libheif that could be triggered by a specially crafted, malicious image.

However, the reason a bug in a public-facing forum could escalate into a compromise of internal employee accounts lies in OpenAI’s identity management architecture. Like many modern enterprises, OpenAI utilizes a Single Sign-On (SSO) system to streamline access across its various services. The public forum offered a "Sign in with OpenAI" option, which utilized the same underlying identity provider that employees use to access internal tools like ChatGPT, Codex, and GitHub.

By exploiting the libheif flaw to achieve Remote Code Execution (RCE) on the forum server, the Hacktron team gained control over the environment where these SSO tokens were processed. This allowed them to intercept or manipulate sessions, effectively taking over the accounts of OpenAI staff members who were active on the forum. Because the login system was shared, the researchers did not need to steal passwords or bypass multi-factor authentication (MFA) for each individual service; the initial breach of the forum’s trust boundary provided a "skeleton key" to the employees’ broader digital workspace.

Hacktron emphasized that this was primarily an OpenAI identity configuration problem rather than an inherent flaw in the Discourse software. Any first- or third-party service integrated into the same SSO umbrella could have potentially granted the same level of lateral movement.

The Technical Chain: From Memory Leaks to RCE

The vulnerability at the heart of the "HEIF Heist," as Hacktron dubbed the project, is tracked as CVE-2026-32882. While initial reports from the National Vulnerability Database (NVD) and libheif’s own advisories described the flaw as an "out-of-bounds read"—a type of bug that can crash a program or leak sensitive data from nearby memory—the researchers proved it could be far more dangerous.

In modern cybersecurity, an out-of-bounds read is often the first step in bypassing Address Space Layout Randomization (ASLR), a core security feature that randomly arranges the address space positions of key data areas of a process. ASLR is designed to prevent attackers from knowing where to jump in memory to execute malicious code. By using the libheif bug to leak memory addresses, the researchers were able to "map" the server’s memory, effectively neutralizing ASLR.

The challenge then became turning this memory leak into a functional RCE exploit. This is where the researchers turned to AI. They initially attempted to use Claude Opus 4.8 to assist in writing the exploit code, but the model struggled with the complexities of the memory corruption and the specific environment of the forum server. Despite several sessions of prompting and debugging, the older model could not reliably bridge the gap between a crash and a controlled execution.

The breakthrough occurred on the evening of July 24, 2026, when Anthropic released its next-generation model, Claude Opus 5. In a fresh session, the researchers presented the same problem to the new model. Within a matter of hours, Opus 5 produced a working exploit that could successfully bypass the server’s defenses and grant the researchers a command shell.

How the Researchers Used AI

The use of Claude Opus 5 in this research highlights the evolving debate over AI safety and the effectiveness of "guardrails." Like most frontier models, Opus 5 is equipped with safety filters designed to prevent it from generating malicious code or assisting in cyberattacks. To circumvent these protections, the Hacktron team did not use traditional "jailbreaking" techniques. Instead, they framed the request within a legitimate research context.

The researchers pointed the model at their own test server, which they described as a "capture-the-flag" (CTF) practice target. By providing the model with the specific version numbers of the libraries involved and the memory leaks they had already discovered, they allowed the AI to work in an automated loop of trial and error. Even with this automation, the researchers noted that the process was not entirely "hands-off." Skilled human direction was required to interpret the AI’s output, refine the prompts, and handle the nuances of the target environment.

This case reinforces findings recently reported by both Anthropic and OpenAI: that while AI may not yet be capable of planning an entire end-to-end cyber campaign autonomously, it is drastically reducing the "time-to-exploit" for known vulnerabilities. What might have taken a team of expert exploit developers days or weeks of manual labor was compressed into a single evening.

The broader implications of this were seen in Hacktron’s wider "HEIF Heist" campaign. Over a two-month period, the team identified similar image-processing vulnerabilities in software used by several major tech firms, including Meta, Slack, and Shopify. The total cost in AI usage fees for the entire campaign was less than $3,000. While some of the claims regarding these other companies remain under verification, the confirmed patch for Next.js (a popular web framework) and the response from Vercel suggest that the vulnerability class is widespread.

Response and Remediation

OpenAI moved quickly once the vulnerability was reported. According to Hacktron, the company confirmed a fix for the SSO-related flaw approximately 14 hours after receiving the initial report. On September 1, 2026, OpenAI paid the researchers a $6,500 bounty.

In a statement regarding the payout, OpenAI clarified that the award was specifically for the "OpenAI-side finding"—the identity and login system weakness—rather than the vulnerability in Discourse itself. The company noted that testing the open-source forum software was technically outside the scope of its primary bug bounty program, but the severity of the resulting account takeovers warranted the payment.

OpenAI has not publicly detailed the specific mechanics of the login flaw, choosing instead to confirm the resolution through the bounty payment and the implementation of the fix. For its part, Hacktron was careful to limit the scope of its intrusion. Upon gaining access to the internal GitHub repository via an employee’s Codex link, they triggered only a single, harmless pull request. They did not read proprietary source code, merge any changes into production, or access any customer data.

However, the researchers warned that the potential impact could have been catastrophic. Because employees often connect various productivity services to their ChatGPT and Codex accounts, the same SSO access could, in theory, have allowed the team to pivot into Slack channels, internal emails, and more sensitive areas of the GitHub environment.

What to Do

The "HEIF Heist" serves as a stark reminder of the risks inherent in the modern software supply chain and the dangers of "trust transitivity" in SSO environments.

For administrators of Discourse servers, the lesson is immediate: the vulnerability in libheif was actually patched in version 1.22.0 in May 2026, months before Hacktron’s research. However, because the forum’s server image was built on Debian 12, it continued to ship with an older, unpatched version of the library (1.19.7). This "packaging lag" is a common issue in the Linux ecosystem, where stability is often prioritized over the rapid adoption of new upstream versions.

Discourse has since released several patched versions (2026.7.0, 2026.6.1, 2026.5.2, and 2026.1.6). Organizations running self-hosted instances of Discourse are urged to rebuild their server images to ensure the underlying system libraries, not just the web application, are up to date. Sites hosted directly by Discourse were patched automatically and were not at risk during the researchers’ testing.

The broader takeaway for the cybersecurity industry is the need to re-evaluate the security of public-facing assets that share identity providers with internal systems. When a "low-trust" environment like a community forum is allowed to generate tokens that are valid for "high-trust" environments like source code repositories, the security of the entire organization is only as strong as the forum’s image-processing library.

As of mid-September 2026, there is no evidence that this specific exploit chain has been used by malicious actors in the wild. It does not appear on the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) list of known exploited vulnerabilities. However, as AI models like Claude Opus 5 and GPT-5.6 Sol continue to lower the barrier to entry for sophisticated exploit development, the window between the disclosure of a bug and its automated exploitation is likely to continue shrinking.