Hacktron says Claude-assisted research reached some OpenAI accounts

Hacktron disclosed in September 2026 that researchers had used Anthropic’s Claude in human-directed security research that reached some OpenAI ChatGPT and Codex accounts in July. Hacktron says they combined a vulnerability in Discourse, the software behind OpenAI’s community forum, with a separate OpenAI sign-in flaw. OpenAI said it narrowed Community sign-in token permissions and revoked affected tokens and sessions.

How the reported access chain worked

Hacktron says the researchers began with image uploads to OpenAI’s Discourse-hosted community forum. A malformed HEIF image could trigger remote code execution (RCE)—running code on a server—through Discourse’s image-processing path. Discourse’s advisory identifies the underlying issue as CVE-2026-32882, a vulnerability in the libheif image-decoding library.

Hacktron says the researchers then combined access through the forum with a separate flaw in OpenAI’s single sign-on (SSO), a system that lets people use one sign-in to access connected services. The two issues together reportedly gave them access to some ChatGPT and Codex accounts. The image-processing vulnerability was in a dependency used by Discourse, not in OpenAI’s own source code.

What Claude Opus 4.8 and Opus 5 did

Hacktron says Claude Opus 4.8 helped identify the vulnerable libheif package and produce an exploit when address space layout randomization (ASLR)—a defense that randomizes where software is loaded in memory—was disabled. The researchers could not make that exploit work reliably against Discourse’s default configuration.

After Anthropic released Claude Opus 5, Hacktron says a new session produced a working local ARM64 exploit within three hours. The researchers then adapted it for Discourse’s x86-64 environment. Hacktron describes people directing and supervising the work; Claude did not carry out the OpenAI test autonomously.

What the researchers say they accessed

Hacktron says the researchers reached multiple OpenAI employees’ ChatGPT accounts and used one employee’s connected Codex account to create a harmless proof-of-concept pull request in an internal repository. Hacktron says the researchers did not inspect the repository’s code.

That pull request demonstrated access through the employee’s Codex account. Hacktron’s account of the work does not say that the researchers used connected services such as Slack, email, or GitHub.

OpenAI’s response and the bounty

OpenAI said it narrowed permissions on Community sign-in tokens and revoked affected tokens and sessions. Hacktron says OpenAI confirmed its side of the issue was fixed on July 25, 2026.

Hacktron says OpenAI paid a $6,500 bounty on September 1, 2026, for the OpenAI-side finding. It also says OpenAI specified that testing against the Discourse-hosted community forum was outside the bug-bounty program’s scope.

Discourse’s advisory and patched releases

In a July 28, 2026, advisory, Discourse rated the malformed-HEIF remote-code-execution vulnerability High severity. The advisory lists patched versions 2026.7.0, 2026.6.1, 2026.5.2, and 2026.1.6.