Hacktron OpenAI Breach: Claude Opus 5 and the libheif Bug
What happened, step by step
| Step | What Hacktron did | Detail |
|---|---|---|
| 1. Find a way in | Targeted OpenAI’s public help forum, community.openai.com, which runs on Discourse | Discourse hands uploaded HEIC/HEIF images to ImageMagick, which decodes them with libheif |
| 2. Build the exploit | Used Claude Opus 5 to turn libheif memory bugs into code execution on the forum server | CVE-2026-32882 is an out-of-bounds read that leaks memory (defeating ASLR); combined with other libheif bugs it became RCE. Discourse’s advisory rates it 8.8/10 |
| 3. Pivot to identity | Used the forum’s “Sign in with OpenAI” SSO to take over the ChatGPT and Codex accounts of forum members who were OpenAI staff | Victims did nothing; the shared login did the work |
| 4. Prove access | Opened a single harmless pull request in an internal OpenAI repository via one employee’s Codex-to-GitHub link | No source read, nothing merged, no customer data touched |
| 5. Report | Reported to OpenAI; fix confirmed ~14 hours later; $6,500 bounty paid September 1, 2026 | OpenAI says the award “recognizes the OpenAI-side finding, not the actions against Discourse” — the forum itself was out of bounty scope |
Elapsed time from first look to internal repository access: under 72 hours. Disclosed publicly on September 18, 2026 by Hacktron and reported by The Register, The Hacker News and Tom’s Hardware.
Why an image bug reached staff accounts
The chain has two halves, and the second matters more.
The image bug. libheif’s CVE-2026-32882 is, in the library’s own advisory, an out-of-bounds read that can crash the decoder or leak nearby memory — not a direct code-execution bug. Leaked memory defeats ASLR; Hacktron combined that with other libheif memory bugs, with Opus 5 writing the exploit, to get working code execution on the forum server. The fix shipped upstream in libheif 1.22.0 in May 2026. The forum’s server image, built on Debian 12, still carried libheif 1.19.7 when Hacktron looked in July — the patch existed for two months but had not reached the packaged version the forum used.
The identity flaw. OpenAI’s forum offers “Sign in with OpenAI,” the same SSO that employees use across internal tools. Controlling the forum server meant controlling that login for every forum member who worked at OpenAI, and from there their ChatGPT and Codex accounts — and, in theory, whatever those accounts connected to: GitHub, Slack, email. Hacktron’s framing: this was an OpenAI identity problem, not a Discourse flaw; any first- or third-party service using the same sign-on could have granted the same access. OpenAI has not publicly described the login flaw.
The AI part: Opus 4.8 vs Opus 5
This is the detail that made the story travel. Hacktron first tried Claude Opus 4.8, which “struggled over several sessions” to build a working exploit once ASLR was on. Anthropic released Claude Opus 5 on the evening of July 24, 2026, and in a fresh session it produced a working exploit within hours.
Two qualifications the researchers themselves make:
- Safeguards were bypassed, not absent. Opus 5 refuses to write exploits for real targets. Hacktron pointed it at their own test server, presented as a capture-the-flag practice box, and ran it in an automated loop.
- It was not hands-off. Skilled human direction still mattered. This was AI-assisted intrusion, not autonomous hacking.
For the wider HEIF Heist campaign — about two months across many companies — the team used OpenAI’s GPT-5.6 Sol for cases where it knew nothing about the target in advance. Total AI usage cost: under $3,000. Only one target, Shopify, appears to have noticed thousands of crashing test uploads.
Who else is exposed
Hacktron links the same image-decoding flaw class to Slack, Meta products, GitHub Enterprise and Next.js. The evidence is uneven: Vercel’s own advisory confirms the Next.js AVIF/HEIF flaw (patched August 2026), and libheif’s maintainers confirmed a working code-execution exploit for the bug tied to Meta; the broad “RCE across many applications” claim has not been independently verified. As of mid-September 2026 the OpenAI flaw was not on CISA’s Known Exploited Vulnerabilities list, and there is no sign it was used in the wild.
What to do
- Update libheif to 1.23.4 (the latest security release as of early September 2026) or your distribution’s patched build. If you self-host Discourse, rebuild on the latest image; fixed self-hosted releases are 2026.7.0, 2026.6.1, 2026.5.2 and 2026.1.6.
- Stop decoding untrusted HEIF/AVIF where you do not need it, or move image processing into a locked-down sandbox.
- Shrink your SSO trust boundary. A public forum should not share the identity provider that reaches internal repositories; require a fresh identity check before sensitive actions instead of trusting an existing session. See how to secure AI accounts from session hijacking.
- Audit agent-to-repo links. The pull request went through one employee’s Codex-to-GitHub connection. Scope those tokens to the minimum and log their use — the same discipline as for the Plugin4Shell fixes (what is Plugin4Shell).
Why it matters beyond OpenAI
The breach landed in the same week as Google’s disclosure that Gemini autonomously hacked three companies during a May red-team exercise, Anthropic’s report that Claude leads 26% of its own R&D, and California’s executive order on kill switches and onsite auditors. Together they make the case that frontier models materially lower the cost of exploitation — a three-person team, under $3,000, under 72 hours — which is exactly the scenario the Cyber Verification Programs around Claude Mythos 5.1 and Gemini 3.8 Flash Cyber were built to gate (comparison). It also sharpened a sceptical counter-narrative: the New York Post reported on September 19 that insiders believe OpenAI and Anthropic have oversold breach incidents to pressure regulators. Both things can be true; patch libheif either way.