Security researchers have demonstrated how artificial intelligence tools can assist in identifying and analyzing complex security weaknesses after a team from security firm Hacktron used Anthropic’s Claude Opus 5 model to chain two vulnerabilities and gain access to several OpenAI employee accounts during a controlled research exercise. The activity involved ChatGPT and Codex accounts belonging to OpenAI staff members and eventually reached an internal OpenAI code repository. However, the research was not a real-world attack. Hacktron reported the findings to OpenAI, verified access through a harmless pull request, and stopped further testing. According to the researchers, the entire process from initial discovery to internal access took less than 72 hours.
OpenAI confirmed the issue was fixed approximately 14 hours after receiving the report and awarded Hacktron a $6,500 bug bounty on September 1. The company clarified that the reward recognized the OpenAI-related security finding and not any actions involving Discourse, the open-source software powering OpenAI’s public help forum. OpenAI has not publicly disclosed details about the login weakness involved in the chain, but confirmed the resolution through the security fix and bounty payment. Hacktron stated that it carefully limited its activity during the research and did not access source code, merge changes, deploy software, or view customer data. When a Codex link connected to OpenAI’s GitHub environment triggered access to an internal repository, researchers only created a single pull request as proof of impact. The security chain began with a vulnerability affecting image processing within the Discourse forum software. OpenAI’s public forum supports a “Sign in with OpenAI” option, which uses the same single sign-on (SSO) system used by employees across other services. Hacktron explained that after gaining control of the forum server, the shared authentication system allowed researchers to access ChatGPT and Codex accounts of forum members working at OpenAI without requiring action from those users. The researchers emphasized that the issue was related to identity management and SSO trust relationships rather than a direct flaw in Discourse itself. They noted that any external or internal service connected to the same authentication system could potentially create similar security concerns if compromised.
The initial entry point involved an image-processing vulnerability in Discourse. The forum processes uploaded HEIC and HEIF images through ImageMagick, which relies on the libheif library for handling these file formats. A vulnerability tracked as CVE-2026-32882 allowed specially crafted images to cause memory corruption. Discourse’s advisory classified the issue as a remote code execution vulnerability with a CVSS score of 8.8. Hacktron researchers said they combined memory-related issues in libheif with additional analysis, assisted by AI tools, to turn the vulnerability into code execution against the forum server. The upstream issue was fixed in libheif version 1.22.0 in May 2026, but researchers found that the forum environment they tested was still using an older version of the library. Discourse-hosted services had already received updates, while self-hosted deployments using affected versions were advised to update to releases containing the security fix. The research also highlighted the growing role of artificial intelligence in security testing. Hacktron researchers said earlier attempts using Claude Opus 4.8 were unable to complete the exploit development process after security protections such as Address Space Layout Randomization (ASLR) were enabled. After Anthropic introduced Claude Opus 5, researchers reported that the newer model was able to assist in developing a working exploit within hours in a controlled environment. The team said the model was not operating independently and that experienced human guidance remained necessary throughout the process. The researchers also described safeguards within AI models designed to prevent harmful exploitation assistance and explained that testing was conducted against their own controlled environment.
The case reflects broader discussions around AI-assisted cybersecurity research and how advanced models may reduce the time required for vulnerability analysis. Security organizations have reported that AI tools are increasingly being evaluated for both defensive research and offensive capabilities. Hacktron also referenced a wider project called HEIF Heist, where researchers investigated similar image-processing weaknesses across multiple platforms. Some of the findings have been confirmed by vendors, while broader claims across different applications remain under review. The research highlights the importance of maintaining updated software libraries, reviewing third-party integrations, and limiting trust relationships between public-facing services and internal systems. Organizations using services that process HEIC, HEIF, or AVIF image formats are advised to keep related libraries updated and consider additional protections such as sandboxing image-processing operations. Security teams should also review single sign-on configurations and reduce unnecessary trust connections between external services and sensitive internal applications. While the OpenAI-related issue was identified through responsible disclosure and there is no indication it was used against users in real-world attacks, the research demonstrates how security weaknesses in connected systems can create broader risks when authentication systems are shared across multiple environments.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
