Security researchers used Anthropic’s Claude Opus 5 to help develop an exploit that became part of an attack chain reaching OpenAI’s private GitHub environment in less than 72 hours.
The Hacktron AI team chained two separate weaknesses: a remote code execution flaw affecting OpenAI’s Discourse-powered community forum and a weakness in OpenAI’s single sign-on system. According to Hacktron, the researchers disclosed the issues rather than pursuing further access, and OpenAI later paid them a $6,500 bug bounty.
The case shows how rapidly improving AI tools can accelerate exploit development, while familiar weaknesses in identity and third-party software still determine how far an attacker can go.
Claude Opus 5 helped turn an image bug into working RCE
Hacktron’s entry point was community.openai.com, which runs on the Discourse platform. According to the researchers, HEIF and HEIC image uploads passed through ImageMagick and the libheif image-decoding library, where they identified a heap buffer overflow that could be exploited to execute remote code.
The researchers initially used Claude Opus 4.8 to develop the exploit. Hacktron said the model could make it work when address-space layout randomization was disabled but struggled to produce a reliable attack against Discourse’s default configuration.
After Anthropic released Claude Opus 5 on July 24, the researchers gave the newer model the same problem. Hacktron said Opus 5 produced a working ARM64 exploit within three hours and later adapted it to Discourse's environment.
“Within hours of Opus 5’s release, we gave it the same problem, and it succeeded,” Hacktron researchers said, per TechCrunch.
By July 25, Hacktron said it had achieved remote code execution and administrative access to OpenAI’s community forum.
An SSO weakness turned forum access into a larger breach
Compromising the forum was only the first step.
Hacktron separately discovered that session tokens associated with OpenAI’s forum authentication could remain valid for ChatGPT and Codex, a weakness the researchers traced to OpenAI’s identity infrastructure.
Because ChatGPT and Codex can connect to other workplace services, Hacktron said compromised accounts could potentially expose GitHub, Slack, and email, depending on the integrations associated with the account.
Hacktron eventually gained access to an employee account whose Codex environment was connected to OpenAI’s GitHub organization. According to the researchers, they instructed Codex to create a harmless pull request in OpenAI’s internal monorepo to demonstrate the impact without examining sensitive source code.
Quartz said that OpenAI’s review found “limited reads” of private repository metadata and code. The company also narrowed permissions on community sign-in tokens and revoked affected tokens and sessions, while Discourse patched the image-processing vulnerability.
What security teams should learn from the attack chain
The incident shows how one vulnerability can become far more serious when identity systems and connected services extend its reach.
Security teams should pay particular attention to three areas:
- Limit SSO trust: Tokens issued to lower-risk services, such as forums, should not automatically grant access to more sensitive applications.
- Audit third-party software: Community platforms and support tools can serve as entry points to critical systems when identities and integrations overlap.
- Track upstream fixes: TechCrunch noted that the libheif flaw had been fixed months earlier but was not assigned a CVE, which may have made the vulnerable dependency easier to miss.
The AI component matters too. Quartz reported that Hacktron’s broader research project cost less than $3,000 in AI model usage. Hacktron also said Opus 5 solved an exploit-development problem that Opus 4.8 could not reliably handle.
The OpenAI incident shows that AI may reduce the time and specialized expertise needed to develop working exploits. But the path into sensitive systems still relied on a familiar combination of vulnerable software, excessive trust in tokens, and connected accounts.
Attackers are also hijacking authenticated Claude sessions with infostealer malware, allowing them to burn through paid AI usage without stealing users’ passwords.