SAN FRANCISCO (Sept. 18, 2026) — Security researchers at startup Hacktron AI say they used Anthropic’s Claude Opus 5 to help chain two critical bugs that let them take over multiple OpenAI employees’ ChatGPT accounts — including a path into internal GitHub via Codex — then proved access with a harmless pull request, according to the team’s own write-up and follow-on coverage by TechCrunch and the Wall Street Journal.

This was an ethical bug-bounty engagement, not a malicious nation-state operation. Hacktron reported the findings to OpenAI and Discourse, coordinated patches, and received a $6,500 bounty from OpenAI for the OpenAI-side finding. OpenAI said Discourse-hosted community.openai.com testing was out of scope for its bounty program; the award covers the SSO/identity impact on OpenAI products.

The exploit chain: HEIC upload → Discourse RCE → SSO → ChatGPT/Codex

In a Sept. 13 blog post, researchers Harsh Jaiswal, Mohan Pedhapati, and Rahul Maini describe discovering a heap buffer overflow in libheif reached through Discourse’s HEIC/HEIF image-upload path (ImageMagick → libheif) on OpenAI’s community forum. A specially crafted image yielded remote code execution on the Discourse environment.

They then exploited an OpenAI SSO identity flaw: compromising the forum’s “Sign in with OpenAI” flow allowed takeover of ChatGPT and Codex accounts for users who had logged into the forum — including employees whose Codex was linked to OpenAI’s GitHub organization. Until patches landed, the team wrote, any user or employee logging into the help forum could have had those accounts taken over, with potential reach into connected services such as GitHub, Slack, and email.

To demonstrate access without reading internal source, they used an employee’s Codex to open PR #1186742 in OpenAI’s internal monorepo openai/openai, then stopped testing. The full path from initial finding to repo proof of concept unfolded on July 25, 2026, in under 72 hours. OpenAI confirmed an OpenAI-side fix roughly 14 hours after the Bugcrowd submission; Discourse patched via HackerOne within days and published advisory GHSA-vhm9-85gw-x335.

Opus 4.8 struggled; Opus 5 succeeded the same day

Hacktron said Claude Opus 4.8 struggled across several sessions to produce a reliable exploit with ASLR enabled. After Anthropic released Opus 5, a new session produced a working ARM64 exploit within hours and then an x86-64/jemalloc port matching Discourse’s environment. “Within hours of Opus 5’s release, we gave it the same problem and it succeeded,” the post states.

TechCrunch, citing Gray Swan CEO Matt Fredrikson, framed the broader stake: frontier models compress scarce exploit expertise into compute — “If it can happen to them … it could happen to anyone.” Hacktron emphasized the work was guided research with responsible disclosure, not fully autonomous hacking, while arguing AI is eroding “security through complexity” that once protected ordinary firms.

Dated July 25 discovery / Sept. 13–18 disclosure cycle 2026: libheif + OpenAI SSO chain; PR #1186742 PoC; OpenAI fix ~14h; $6,500 bounty (OpenAI-side only); Opus 5 succeeded where Opus 4.8 did not.

Sources