Claude Opus 5 turned an undocumented image bug into access to OpenAI's internal code repo

Three researchers at the security firm Hacktron used Anthropic's Claude Opus 5 to build a working exploit for a memory bug in an image-decoding library, then chained it with a single sign-on weakness to reach an internal OpenAI code repository — all inside 72 hours in late July 2026. The bug had been quietly fixed upstream a year earlier without ever being flagged as a security issue, so patched versions never reached many distributions. If you run a self-hosted Discourse forum, or any service that accepts user-uploaded images, this one is worth an hour of your week.

What happened, in plain English

OpenAI runs a public community forum at community.openai.com. It is built on Discourse, a widely used open-source forum platform that many companies self-host. Like most forums, it lets users upload pictures.

When someone uploads an image, Discourse hands it to ImageMagick — a standard image-conversion toolkit — to resize it and make thumbnails. For HEIC/HEIF images (the format an iPhone produces by default), ImageMagick passes the file on to a library called libheif, which does the actual decoding.

libheif had a heap buffer overflow: given a deliberately malformed HEIF file, it wrote data outside the memory area it was supposed to use. A buffer overflow is a bit like a form where one field accepts more characters than the box was sized for — the extra text spills onto whatever is printed next to it. Spill the right bytes in the right place and you stop corrupting data and start controlling what the program does.

Here is the awkward part. According to Hacktron, the vulnerable code had been changed upstream the previous year, but the commit was not documented as a security fix and received no CVE — no Common Vulnerabilities and Exposures identifier, the public ID that tells packagers and scanners "this is security, backport it." Without that label, Linux distributions had no reason to rush the fix into their packages. The forum server was still running a vulnerable build in July 2026.

The researchers uploaded a crafted HEIF image and got remote code execution — the ability to run their own commands — on the forum server. That was step one. Step two was worse, and it was not Discourse's fault.

Are you affected? What to do now

Most readers are not OpenAI, but plenty of organisations run a public forum and a lot more process user-supplied images. Work down this list:

• If you self-host Discourse: rebuild your container against current code. Discourse published advisory GHSA-vhm9-85gw-x335 ("RCE via malformed HEIF file") on July 28, 2026, with patch and rebuild guidance. A rebuild is what actually pulls in the fixed libheif and libde265 packages — editing settings will not do it. Hosted Discourse customers were patched by the vendor.
• If any of your services accept image uploads: check which libheif version your image pipeline links against. Hacktron reports the affected range spans 1.19.x, 1.20.x, 1.22.x and 1.23.x, and points to v1.23.4 as the current upstream security release, noting that v1.23.2 has already been superseded. Because the original fix carried no CVE, your vulnerability scanner may show nothing — check the installed version by hand.
• Restrict what your converter will parse. If you do not need HEIF or AVIF, turn those formats off. ImageMagick's security policy file lets you allow only the formats you actually use (GIF, JPEG, PNG for most sites). Fewer decoders means fewer places to go wrong.
• Sandbox image conversion. Hacktron's own recommendation: isolate image-processing pipelines in hardened, ephemeral environments. A decoder crash should not be a foothold on a machine that can reach anything else.
• Audit your identity boundaries — this is the part most people should act on. Ask: does a low-trust public property (community forum, marketing site, status page, support portal) share an identity provider, session domain or token scope with production tooling? If compromising the least important box you own lets someone hold a session for something important, fix that mapping.
• Review what your AI coding assistants can reach. Codex, Copilot, Claude Code and similar tools are commonly linked to a source-control organisation with broad scopes. Whoever holds that account session inherits that access. Enumerate the OAuth grants on your GitHub/GitLab org, remove ones nobody uses, and scope the rest down.

If you run no forum, no image uploads and no AI assistant wired into your repos, there is nothing here you must patch today. Read the next section anyway — the timeline is the story.

The expert view

Two things are worth separating, because the headlines have been blurring them.

The access came from identity, not from AI. Remote code execution on a public community forum should be an embarrassing but contained event: rebuild the box, rotate its secrets, move on. It was not contained, because OpenAI's single sign-on let control of the forum host be converted into takeover of employee ChatGPT and Codex accounts. Hacktron is explicit that this second link "is not Discourse-specific. It is an OpenAI SSO issue." From there, a compromised Codex account connected to OpenAI's GitHub organisation reached an internal monorepo; the researchers demonstrated impact by opening a harmless pull request (#1186742) and stopped. That is a classic blast-radius failure — a trust boundary that existed on the org chart but not in the token — and it is the finding OpenAI actually paid for: a $6,500 bounty on September 1, 2026. OpenAI noted that testing against community.openai.com was explicitly excluded from its bug bounty programme.

The AI part is about speed, and it is genuinely new in degree if not in kind. By Hacktron's account, Claude Opus 4.8 failed to produce a working exploit across multiple sessions against modern memory protections. Opus 5 shipped on July 24, 2026; a new session produced a working ARM64 exploit on a local Mac within about three hours, then ported it to the target's x86-64 and jemalloc allocator environment. Running in a guided loop against the team's own test instance, it reached RCE by the morning of July 25. Humans still chose the target, judged the crash's exploitability, and handled disclosure — this was skilled operators with a very fast tool, not an autonomous attacker. Hacktron's own framing is the honest one: work that once required a well-resourced team and months of effort compressed into days.

What that changes for defenders is the arithmetic of exposure windows. Turning a known crash into a reliable exploit was, for years, the expensive step that kept a lot of memory-corruption bugs theoretical. If that step is getting cheap, the population of bugs that reach real exploitation grows — and the bugs most at risk are exactly the ones this story turned on: quiet upstream fixes with no CVE, no advisory and no scanner signature, sitting in distribution packages for months. The security-labelling gap in the supply chain is now a much shorter fuse than it was.

Note one discrepancy. Some trade coverage has attached CVE-2026-32882 to this libheif flaw. Hacktron's write-up states the underlying fix received no CVE, and we could not independently verify that identifier against an authoritative vulnerability database before publication — treat the CVE reference as unconfirmed and patch by version number instead.

Still unknown: whether the libheif bug was ever exploited by anyone else before July 2026, how many self-hosted Discourse instances remain unpatched, and what exactly OpenAI changed in its SSO configuration. None of those are disclosed.

The disclosure handling, at least, was fast: Hacktron reported on July 25, OpenAI confirmed a fix roughly 14 hours later that same day, Discourse acknowledged on July 26, had a fix ready July 27 and published the advisory July 28. Hacktron's detailed write-up followed in September, drawing broad coverage on September 18, 2026.

Official sources

• Hacktron AI — "Hacking OpenAI" (primary research write-up)
• Discourse security advisory GHSA-vhm9-85gw-x335 — "RCE via malformed HEIF file", published July 28, 2026
• libheif releases (strukturag/libheif) — check your installed version against the current security release
• Coverage: TechCrunch — "Researchers used Anthropic's Claude to hack into OpenAI"
• Coverage: The Hacker News — "Claude Opus 5 Helped Researchers Take Over OpenAI Staff Accounts via Chained Flaws"
• Coverage: The Register — "Researchers used Claude to hack OpenAI employees' ChatGPT accounts"