On July 25, 2026, security firm Hacktron exploited a series of weaknesses involving Anthropic’s Claude Opus 5 to penetrate OpenAI’s developer ecosystem. The attack began in OpenAI’s Discourse forum for community users, eventually reaching ChatGPT and Codex accounts and even touching a private source-code repository. The incident underscores risks in identity trust spanning interconnected cloud services.
How the Attack Unfolded
Researchers discovered that OpenAI’s help forum—hosted via Discourse—handled image uploads in a way that exposed it to attack. While standard image validation tools like FastImage were in place, they didn’t support HEIC or HEIF formats. This gap caused Discourse to defer processing of those images to ImageMagick’s `magick` utility, which in turn exposed the `libheif` parser to untrusted image data. The version in use—libheif 1.19.7 on Debian 12—contained a heap-buffer overflow vulnerability. Debian 13 already included a patched version, avoiding some of these problems.
Initially, Hacktron used Claude Opus 4.8 to construct an exploit. They were able to attain remote code execution (RCE) only when address space layout randomization (ASLR) was disabled. Attempts to make it work reliably under ASLR failed. But once Claude Opus 5 was released on July 24, the researchers repeated the process. Within about three hours, they had a working exploit against ARM64 Mac systems, and then adapted it to target the x86-64 environment and the `jemalloc` allocator used by Discourse Cloud. By later that day, they gained RCE through image uploads on OpenAI’s own forum.
Escalation Through Identity Misconfigurations
Having RCE on the forum alone didn’t grant access to OpenAI’s internal monorepo. But Hacktron uncovered an identity misconfiguration: forum sessions were insufficiently isolated, and trusted identity tokens allowed them to hijack employee ChatGPT and Codex accounts. Because those accounts were linked to OpenAI’s GitHub organization, the researchers could open a pull request in the private `openai/openai` repository. To prove access responsibly, they submitted a harmless PR (number 1186742), then paused further probing and reported their findings.
OpenAI verified the problem chain between roughly 08:00 and 10:00 UTC on July 25. A fix was deployed about 14 hours later at 22:49:45 UTC. Discourse patched the related issue on its side with advisory GHSA-vhm9-85gw-x335 on July 28. OpenAI awarded the researchers $6,500 for the portion of the bug in its own systems, while noting that testing the community forum was not within the scope of its formal bug bounty program.
Recommended Remediations
System administrators using Discourse should update to the latest version and rebuild containers—they can’t rely on web interface updates alone to replace vulnerable base images. Those accepting HEIC, HEIF, or AVIF image uploads should apply patched versions of `libheif` and `libde265`, disable needless decoders, and run conversion pipelines in sandboxed environments. ImageMagick’s security policy should be limited to trusted formats—such as GIF, JPEG, PNG—to reduce exposure.
Why This Matters: The incident illustrates how flaws in peripheral services—image processing, forum software, identity trust—can cascade into full system compromise. Claude Opus 5 helped streamline exploit generation, compressing what would once take days of manual work into a few hours. As AI assistance in offensive security becomes more capable, organizations must rethink what is within their threat perimeter. Identity boundaries, image parsers, and third-party libraries are no longer low-risk; they need tight segregation, vigilant patching, and rigorous review. Watching closely: future models may assist in identifying vulnerabilities—but also in weaponizing them faster than ever before.
