Claude Opus 5 Used to Breach OpenAI Staff Accounts

Security researchers at Hacktron used Anthropic's newly released Claude Opus 5 to build a working exploit that chained a libheif image-parsing bug (CVE-2026-32882) with a flaw in OpenAI's single sign-on, taking over ChatGPT and Codex accounts of several OpenAI employees and reaching an internal OpenAI code repository. It was an authorized test: OpenAI fixed the issue within 14 hours and paid a $6,500 bounty. The takeaway is not that AI hacked OpenAI, but that a frontier model turned a hard-to-weaponize bug into a working exploit in hours, under human direction.

The chain had two links. The first was CVE-2026-32882, an out-of-bounds read (CWE-125) in libheif, the library that decodes HEIC/HEIF images, which was reachable through image processing on OpenAI's Discourse community forum. The second was a weakness in OpenAI's SSO that shared authentication across public and internal services, so access won on the public forum extended inward. On its own the libheif bug is a modest CVSS 7.1; chained with the SSO flaw, it became a path from a public web property to employee accounts and internal code.

What makes this notable is the tooling. The Hacktron team reported that Claude Opus 4.8 struggled to produce a reliable exploit, but after Claude Opus 5 was released on July 24, 2026, the newer model "produced a working exploit within hours" when the target was presented as a capture-the-flag-style challenge on a test server. The researchers were explicit that this was not push-button hacking: "skilled human direction still mattered, and this was not automated hacking with no one at the controls." They gained control of several employees' ChatGPT and Codex accounts, accessed an internal repository, and, as proof, opened a single harmless pull request while reading no source code.

Did an AI hack OpenAI on its own?

No, and the distinction matters for defenders. This was authorized red-team research in which a capable model dramatically compressed the hardest, most time-consuming step, turning a known-but-awkward memory bug into a functioning exploit, while humans set the target, chained the flaws, and made the judgment calls. The security-relevant shift is not autonomy but leverage: work that previously demanded a specialist's days of exploit development now takes hours with model assistance. That lowers the cost of exploiting exactly the "medium-severity, hard-to-reach" bugs that defenders often deprioritize. It is the offensive mirror of the incidents where OpenAI's own agents chained low-severity flaws at machine speed and an AI agent escaped a sandbox by chaining medium-rated CVEs.

What should defenders take from this?

Two things. First, chains beat scores: a 7.1 image-parser bug and an SSO oversight are individually unremarkable, but composed they reached internal code. Attackers and their models think in paths, not CVSS rankings. Second, shared authentication boundaries are the multiplier here, an SSO that treats a public forum and internal services as the same trust zone converts any foothold into a deep one. Segment identity between public and internal properties, and assume that the effort required to weaponize a reachable bug is now much lower than your triage assumptions bake in.

Our read

This is the supervised-adversary-simulation thesis arriving from the offensive side. The story of 2026 is not that models are autonomous super-hackers; it is that a skilled operator plus a frontier model can chain ordinary flaws into real access faster than defenders expect, which raises the value of every reachable "low-priority" bug in your estate. A vulnerability scanner rates a libheif OOB read a medium and moves on; an adversary simulation asks the question that actually predicted this, can something reach that image parser, and does access there extend anywhere it should not? For teams, the concrete moves are to separate public and internal SSO trust, to test whether your own reachable-but-modest bugs chain into something worse, and to stop treating disclosure-to-exploitation timelines as if exploit development were still the bottleneck. It increasingly is not.

Reporting by The Hacker News and SecurityWeek; CVE-2026-32882 rated CVSS 7.1, CWE-125 per the NVD record; incident details per Hacktron and OpenAI. Sources linked above.

Frequently asked questions

What happened in the Hacktron OpenAI test?
Authorized researchers used Claude Opus 5 to build an exploit chaining a libheif image bug (CVE-2026-32882) with an OpenAI SSO flaw, took over several OpenAI staff ChatGPT and Codex accounts, and reached an internal code repository. OpenAI fixed it in 14 hours and paid a $6,500 bounty.

Did Claude Opus 5 hack OpenAI autonomously?
No. Researchers directed the effort; the model produced a working exploit within hours after an earlier model failed. As the researchers put it, skilled human direction still mattered and it was not automated hacking with no one at the controls.

What is CVE-2026-32882?
It is an out-of-bounds read (CWE-125) in libheif, the HEIC/HEIF image-decoding library, rated CVSS 7.1. Reachable via image processing on OpenAI's forum, it formed the first link in the exploit chain.

What is the defensive lesson?
Attackers chain modest flaws into serious access, and AI assistance is lowering the cost of weaponizing reachable bugs. Segment public and internal SSO trust, and test whether your low-severity reachable bugs chain into something worse.