How Claude Opus 5 reached inside OpenAI
In July 2026 researchers used Claude Opus 5 to turn a Discourse image bug into code execution on OpenAI's forum, then an SSO gap into its internal repo.
In late July 2026, researchers at Hacktron AI used Anthropic's Claude Opus 5 to build a working exploit chain against OpenAI's community forum, take administrative control of it, and finish with enough access to open a pull request inside OpenAI's own code repository. They read no source code, reported everything to OpenAI, and the hole was closed within a day. It is one of the clearest public demonstrations yet that a frontier model can carry an attack from first probe to internal access on its own.
The target
OpenAI runs its community forum at community.openai.com on Discourse, the open-source discussion platform. Discourse is widely deployed and well understood, which is part of why a forum looks like a low-value target. It also offered 'Sign in with OpenAI', a convenience that let forum accounts authenticate through OpenAI's own identity system. That link would matter more than the forum itself.
The way in was an image
The entry point was ordinary image upload. Discourse hands uploaded images to ImageMagick for conversion, and ImageMagick used libheif to decode HEIC files. libheif carried a heap buffer overflow that had been fixed upstream but never backported into the Debian base image the forum ran on. A crafted image, uploaded like any avatar or screenshot, was enough to trigger it. That gave the researchers remote code execution, and from there administrator access to the forum.
The pivot that mattered
A forum compromise on its own is usually a low-severity finding. This one did not stay small, because of the single-sign-on link. 'Sign in with OpenAI' ran in both directions: from inside the forum the researchers reached an OpenAI employee's Codex account, and through it the employee's connection to OpenAI's GitHub organisation. That was enough to open a pull request in OpenAI's internal monorepo. They stopped there and read no source. The forum was the door; single sign-on was the hallway to everything behind it.
What it cost the attacker
The economics are the part worth sitting with. An earlier model, Claude Opus 4.8, had failed to produce a working exploit across several sessions once modern memory protections were in play. When Opus 5 arrived, a fresh session produced a working exploit in hours. From the first session to a pull request inside OpenAI took under seventy-two hours, and the wider research it belonged to ran on a few thousand dollars of model time. The skills that used to define a specialist exploit-development team are increasingly available to anyone who can run a model in a loop.
A working exploit chain against a frontier lab now comes out of a single model session.MATT Research
The timeline
- →23 July 2026: the research began, using Claude Opus 4.8, which could not get past the target’s memory protections.
- →24 July 2026: Claude Opus 5 was released; a fresh session produced a working exploit within hours.
- →25 July 2026: remote code execution confirmed on the forum, the finding submitted to OpenAI, and internal access shown with a proof-of-concept pull request.
- →25 July 2026: OpenAI confirmed the fix the same day.
- →1 September 2026: OpenAI paid the bounty through its bug-bounty programme.
The pattern
Two things generalise well beyond this one forum. The first is single sign-on. A convenience that links a minor property to a major identity turns any compromise of the minor property into a compromise of the identity, and the minor property is rarely held to the identity's standard. If a system can sign into your production, it deserves your production's scrutiny. The second is dependencies. The bug lived in an image library, carried into production inside a base image and left unpatched. Neither is exotic. Both are the kind of thing that holds for years, until someone with a cheap, tireless exploit-writer goes looking.
The finding was disclosed responsibly. Hacktron reported it to OpenAI and Discourse, the two coordinated the fix, and OpenAI paid a bounty. This account follows Hacktron AI's own write-up ↗ and reporting by The Information ↗; both are linked from the Record.
Questions
Did Claude Opus 5 actually hack OpenAI?
Yes, as coordinated security research. In July 2026 researchers at Hacktron AI used Claude Opus 5 to gain remote code execution on OpenAI's community forum and reach an employee's account, then reported it to OpenAI, which fixed it within a day and paid a bounty. It was responsible disclosure, not a criminal breach.
Was OpenAI’s source code stolen?
No. The researchers reached the point of opening a pull request in OpenAI's internal repository, which proves code-level access, but they did not read or take source code.
What was the vulnerability?
A heap overflow in libheif, an image-decoding library left unpatched in the Discourse forum's base image and reachable through ordinary image upload. The escalation beyond the forum was an OpenAI single-sign-on gap, not a flaw in Discourse itself.
How long did it take, and what did it cost?
Under seventy-two hours from the first session to internal access. Claude Opus 5 wrote a working exploit where an earlier model had failed, and the wider research ran on a few thousand dollars of model time.
What should security teams take from it?
Two things. Single sign-on turns any compromise of a minor property into a compromise of the identity behind it, so audit what each sign-in can actually reach. And dependencies pulled into base images, like the image library here, need the same patching discipline as your own code.