Claude Opus 5 Leveraged to Chain RCE and OpenAI Staff Account Takeover

In a striking demonstration of how state-of-the-art AI models can accelerate complex, multi-stage exploit chains, security researchers at Hacktron demonstrated a full OpenAI account takeover by combining an unpatched heap memory bug with identity provider flaws. Using Anthropic’s Claude Opus 5 to develop a working Remote Code Execution (RCE) payload, the team exploited an out-of-bounds read vulnerability in the libheif image-parsing library running on OpenAI’s public Discourse forum. Because the forum shared single sign-on (SSO) infrastructure with internal systems, controlling the web host allowed the researchers to hijack employee ChatGPT and Codex accounts and open an unauthorized pull request in an internal OpenAI GitHub repository.

The entire compromise—from initial scoping of the public forum host to reaching internal source code repositories—took less than 72 hours. OpenAI patched the identity flaw within 14 hours of receiving the disclosure and awarded Hacktron a $6,500 bounty.

How the Attack Chain Worked: From Image Parsing to SSO Hijacking

The root vulnerability stems from how media parsing libraries handle binary image streams written in native languages like C/C++. When users uploaded HEIC or HEIF files to OpenAI’s community forum, Discourse handed the rendering task to ImageMagick, which relied on the underlying libheif library. The container image running the forum ran Debian 12 with libheif version 1.19.7—a package vulnerable to CVE-2026-32882.

While public advisories list CVE-2026-32882 as an out-of-bounds read capable of crashing the process or leaking adjacent memory, the researchers utilized that memory leak to defeat Address Space Layout Randomization (ASLR). By defeating ASLR, memory corruption was elevated from a basic denial-of-service condition into arbitrary code execution on the underlying Linux host.

The secondary, critical link in the chain was a trust domain architectural issue. OpenAI’s public forum offered a “Sign in with OpenAI” single sign-on option. Because the public-facing community forum relied on the exact same identity provider and session framework used across staff development tools, compromising the forum host granted access to active SSO tokens. The researchers could impersonate any OpenAI employee registered on the forum without requiring victim interaction. By leveraging a staff member’s active session, the team accessed internal Codex links tied to OpenAI’s GitHub organization, ultimately issuing a single, non-destructive pull request to prove access.

Automated Exploit Generation with Claude Opus 5

The operational highlight of this exercise was the role of artificial intelligence in exploit weaponization. Hacktron initially attempted to build an exploit using Claude Opus 4.8, which struggled across multiple sessions to reliably bypass ASLR once memory protection mechanisms were enabled.

Following the release of Claude Opus 5, the team supplied the model with technical context in an automated execution loop. To bypass Anthropic’s safety guardrails against weaponized exploit creation, the researchers pointed the model at a local test environment framed as a Capture-The-Flag (CTF) target. In a fresh session, Claude Opus 5 produced a fully functional RCE payload within hours.

While skilled human direction remained necessary to guide the system architecture, the LLM drastically compressed the time needed to turn an obscure memory leak into reliable remote code execution. This research aligns with a broader trend across 2026: capable foundation models are significantly lowering the technical barrier and time investment required for low-level software exploitation.

Realistic Blast Radius and Enterprise Impact

The blast radius of this attack chain highlights the severe risk of sharing identity providers across different trust zones. Had this breach been conducted by a malicious threat actor rather than ethical researchers, access to internal staff ChatGPT and Codex sessions could have provided a launching pad into sensitive third-party integrations, including internal Slack workspaces, corporate email, and cloud infrastructure.

The broader campaign, which Hacktron named HEIF Heist, demonstrated that image-processing flaws in native libraries remain a widespread attack surface across large enterprise networks. Similar image-parsing flaws were identified across multiple major tech platforms during the two-month research project, often incurring less than $3,000 in combined AI usage costs across models like Claude Opus 5 and GPT-5.6 Sol.

Mitigation and Defensive Guidance

Organizations using self-hosted Discourse forums, ImageMagick, or custom web services processing user-supplied HEIC, HEIF, or AVIF files should immediately implement the following controls:

• Update Upstream Image Libraries: Upstream maintainers fixed the core vulnerability in libheif 1.22.0, with current secure builds at version 1.23.4. If operating on Linux distributions like Debian, ensure container images are explicitly rebuilt to fetch updated native C libraries rather than relying solely on web application updates.
• Update Self-Hosted Discourse Instances: Update self-hosted Discourse deployments to patched releases 2026.7.0, 2026.6.1, 2026.5.2, or 2026.1.6. Hosted Discourse instances have already been remediated.
• Isolate Identity Provider Trust Domains: Public, lower-trust services (such as discussion forums or help centers) must never share identical SSO tokens or identity provider permissions with internal administrative tools, source code repositories, or production environments. Enforce step-up authentication and strict token scope boundaries when moving between public and internal applications.
• Sandbox Media Parsing Processes: Where HEIF/AVIF parsing cannot be completely disabled, isolate media processing workers inside strict, unprivileged sandboxes (such as gVisor, WebAssembly, or isolated microVMs) to prevent memory corruption bugs from yielding full host privileges.