Claude Opus 5 Helped Researchers Chain Flaws to Access OpenAI Staff Accounts
How Researchers Used AI to Chain Vulnerabilities at OpenAI
Three researchers at security firm Hacktron demonstrated the growing power of AI-assisted security research by using Anthropic's Claude Opus 5 to chain two separate vulnerabilities and compromise multiple OpenAI employee accounts, all in under 72 hours.
The research, dubbed the "HEIF Heist" project, resulted in a USD 6,500 bug bounty payment from OpenAI on 1 September 2026. No customer data was accessed, and the researchers did not read source code or merge any changes.
How the Attack Chain Worked
The exploit relied on linking two weaknesses that, individually, might have appeared low-risk.
**Vulnerability 1: Image Processing Flaw (CVE-2026-32882).** OpenAI's public help forum ran on Discourse, which used libheif version 1.19.7 for image processing. The researchers found that a specially crafted HEIC/HEIF image could corrupt server memory, enabling remote code execution on the forum server.
**Vulnerability 2: Shared SSO Credentials.** OpenAI's "Sign in with OpenAI" single sign-on system shared credentials between the public forum and internal staff systems. Once the researchers had code execution on the forum, they could leverage SSO tokens to access internal employee accounts.
By chaining these two flaws, the team compromised ChatGPT and Codex accounts belonging to several OpenAI employees and created a harmless pull request in an internal GitHub repository to demonstrate the severity of the access.
The Role of AI in Security Research
The researchers initially attempted the exploit using Claude Opus 4.8 but found the model struggled with the complexity. When Claude Opus 5 was released on 24 July 2026, the model produced a working exploit within hours when directed toward a test capture-the-flag target.
This case illustrates a broader trend: AI models are becoming powerful tools for security researchers, significantly reducing the time needed to discover and chain complex vulnerabilities. Hacktron reported finding similar image-decoding flaws across Slack, Meta products, GitHub Enterprise, and Next.js at an AI compute cost of under USD 3,000.
What Organisations Should Do
- Update image processing libraries. Upgrade libheif to version 1.23.4 or later. Disable untrusted HEIF/AVIF decoding or sandbox image processing entirely.
- Limit SSO trust boundaries. Shared authentication between public-facing and internal systems creates lateral movement paths. Require fresh authentication for sensitive actions.
- Assume AI-speed attacks. Vulnerability discovery that previously took weeks now takes hours. Patch management windows must shrink accordingly.
- Invest in bug bounty programmes. Responsible disclosure channels give researchers a legitimate path to report findings before they are exploited maliciously.
Key Takeaway
AI-assisted vulnerability research is compressing discovery timelines from weeks to hours. Organisations must update their patch management and SSO trust boundaries accordingly.
Frequently Asked Questions
Was any customer data compromised in the OpenAI breach?
No. The researchers accessed employee accounts but did not read source code, merge changes, or access customer data. The exercise was conducted under responsible disclosure.
What is CVE-2026-32882?
It is an image-processing vulnerability in libheif version 1.19.7 that allows remote code execution through a specially crafted HEIC/HEIF image. Organisations using libheif should update to version 1.23.4 or later.
How can businesses prepare for AI-assisted cyberattacks?
Shorten patch management cycles, limit SSO trust boundaries between public and internal systems, sandbox media processing pipelines, and maintain an active bug bounty programme.
Need help with cybersecurity compliance?
Cyberkiz helps Sarawak SMEs meet PDPA and NIST CSF requirements.
Learn More