Researchers used Anthropic’s Claude Opus 5 to help weaponize an image-decoder vulnerability, compromise OpenAI’s community forum, take over employees’ ChatGPT and Codex accounts, and reach an internal source-code repository.
The July 25, 2026 operation by Hacktron linked remote code execution in Discourse’s image-processing stack to a flaw in OpenAI’s single sign-on, showing how a breach in a peripheral service can cross identity boundaries into high-value AI development environments.
The attack path began in community.openai.com, OpenAI’s Discourse-based help forum. Hacktron researchers Harsh Jaiswal, Mohan Pedhapati and Rahul Maini examined its upload pipeline and found that HEIC and HEIF images bypassed the usual FastImage checks because the library did not support those formats. Discourse instead invoked ImageMagick’s magick utility, which exposed the underlying libheif parser to attacker-controlled image data.
According to Hacktron, the installed Debian package lacked an upstream security correction, leaving a heap-buffer overflow that supplied out-of-bounds read-and-write primitives during HEIC decoding.
The Discourse Docker image used Debian 12 and contained libheif 1.19.7, while Debian 13 shipped 1.19.8 at the time. Debian later released DSA-6417-1, warning that CVE-2026-32882 and related libheif issues could cause denial of service, disclose memory, or potentially execute arbitrary code when malformed images were processed.
Claude Accelerates Exploitation
Hacktron first tasked Claude Opus 4.8 with auditing the package and building an exploit. It reportedly achieved code execution when address space layout randomization was disabled but failed across several attempts to make exploitation reliable under Discourse’s default ASLR-enabled configuration.
After Anthropic released Claude Opus 5 on July 24, the researchers gave the newer model the same problem. Hacktron said Opus 5 produced a working ARM64 exploit for a local Mac within three hours, then ported it to Discourse’s x86-64 and jemalloc environment.
By 6:00 UTC on July 25, the team had verified local RCE through an image upload; later testing against its own proxied Discourse Cloud instance returned /etc/hosts, after which the generated exploit was used against OpenAI’s forum.
The researchers stressed that this was not fully autonomous hacking. Human expertise remained necessary to direct sessions, validate results and manage disclosure, but AI compressed exploit engineering that previously demanded substantially more time and specialized labor.
Forum-level RCE alone did not expose OpenAI’s monorepo. Hacktron said a separate OpenAI identity misconfiguration allowed a compromised forum session to become a no-interaction takeover of ChatGPT and Codex accounts belonging to active members.
The episode shows why federated identity trust must be reviewed as part of every connected application’s attack surface. Because those products can connect to services such as GitHub, Slack, and email, the potential blast radius extended beyond the forum.
To prove access while avoiding internal source-code review, the researchers instructed an affected employee’s Codex account—connected to OpenAI’s GitHub organization—to open harmless pull request number 1186742 in the private openai/openai monorepo. They then stopped testing, updated their Bugcrowd report, and alerted OpenAI security.
The Wall Street Journal independently reported that Claude-assisted researchers reached an employee ChatGPT account and could propose changes to a confidential repository.
Hacktron reported the OpenAI-side chain between 08:00 and 10:00 UTC on July 25; OpenAI confirmed a fix at 22:49:45 UTC, roughly 14 hours later.
Discourse received a separate HackerOne report, responded on Sunday, prepared a fix by Monday, and published GHSA-vhm9-85gw-x335 on July 28. OpenAI later awarded $6,500 for the OpenAI-side finding, noting that testing community.openai.com itself was outside program scope.
Self-hosted Discourse operators should pull current code and rebuild the application container, because a web-interface update may not replace the vulnerable base image.
Organizations processing untrusted HEIF, HEIC or AVIF files should install security-patched libheif and libde265 packages, disable unnecessary decoders, and isolate conversion inside hardened, ephemeral sandboxes. ImageMagick also recommends restricting deployments to required formats, such as GIF, JPEG, and PNG, through its security policy.
Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC
