Researchers at the security firm Hacktron used Anthropic's Claude Opus 5 to chain two flaws and take over the ChatGPT and Codex accounts of several OpenAI employees, then reach an internal OpenAI code repository. The entry point was an image-parsing flaw: OpenAI's public help forum runs on Discourse, which passes uploaded HEIC and HEIF images to ImageMagick, which reads them through the libheif library. A crafted image corrupted the forum server's memory — Discourse's advisory rates the outcome as remote code execution at 8.8 and tracks it as CVE-2026-32882, while libheif's own advisory and national vulnerability databases describe a narrower out-of-bounds read that can leak memory and defeat ASLR; the researchers say they combined several of those memory bugs, with the model's assistance, into working code execution. Upstream the flaw was fixed in libheif 1.22.0 in May 2026, but the forum's Debian 12 server image still shipped 1.19.7 when the team looked in July. From the forum server, OpenAI's "Sign in with OpenAI" single sign-on — the same SSO staff use elsewhere — handed over employee ChatGPT and Codex accounts without any victim action. Total elapsed time from first look to internal repository access was under 72 hours; the team proved the access with a harmless pull request and went no further. OpenAI fixed the issue in about 14 hours and paid a US$6,500 bounty on 1 September, which it said recognises the OpenAI-side finding rather than the testing of Discourse. Self-hosted Discourse administrators should rebuild on the current image, because a web-interface update alone may not replace the old library; the fixed self-hosted releases are 2026.7.0, 2026.6.1, 2026.5.2 and 2026.1.6.

• Source article