Researchers Used Claude Opus 5 to Reach OpenAI's Internal Code Repository in Under 72 Hours

A three-person team at the AI-assisted security firm Hacktron AI says it went from a first look to a pull request inside OpenAI's private internal code repository in under 72 hours, using Anthropic's Claude Opus 5 to chain together two separate weaknesses. The work was disclosed on September 18 under OpenAI's bug bounty program, and both flaws have been fixed.

How the chain worked

The entry point was not OpenAI's own software. It was community.openai.com, the company's public help forum, which runs on the open-source platform Discourse — and where users sign in with their OpenAI accounts.

Rather than attack Discourse directly, the researchers went after one of its dependencies. When a user uploads an image in Apple's HEIC or HEIF format, Discourse hands the file off for decoding to libheif. That library carried a heap buffer overflow, now tracked as CVE-2026-32882 in version 1.19.7, which a specially crafted image could trigger to gain out-of-bounds read and write access during decoding.

From remote code execution on the forum, the team moved through a weakness in OpenAI's login system to take over the ChatGPT and Codex accounts of several OpenAI employees. Opening one employee's Codex link to OpenAI's code on GitHub triggered a single pull request inside the internal monorepo.

What the researchers deliberately did not do

This was research, not an intrusion. Hacktron reported the flaws, proved the access with a harmless pull request, and stopped. The team says it did not read any source code, merge or ship anything, or touch customer data.

The theoretical reach was much larger. Because staff connect other services to ChatGPT and Codex, the same access could in principle have extended to tools such as GitHub, Slack, and email. That wider reach was available and left untouched.

OpenAI confirmed a fix roughly 14 hours after the report and on September 1 paid the team a $6,500 bounty, noting the award "recognizes the OpenAI-side finding, not the actions against Discourse" — testing the forum platform itself fell outside the program's scope. OpenAI has not publicly described the login flaw.

The uncomfortable finding: the model was the variable

The detail that matters most to defenders is not the bug. According to the researchers, the previous generation of models could not solve the problem they were stuck on. Claude Opus 5 shipped on the evening of July 24; by the next morning they had remote code execution on the forum. The entire two-month campaign cost under $3,000 in AI tokens.

That reframes what a security calendar has to track. Teams have long organised exposure around CVE disclosures and patch cycles. This disclosure argues that frontier model releases now change exposure too — the same codebase, the same researchers, and the same techniques produced a different outcome because the model got better.

There is a patch-hygiene lesson underneath it as well: libheif's maintainers had already changed the faulty code the previous year, but the change was not labelled a security fix and never received a CVE, so it appears not to have been backported to downstream distributions.

Why it matters

The bugs are patched, but the pattern is not going away. AI coding and research tools now sit inside developer identity — connected to code hosts, chat, and mail — so a foothold in a low-priority public property can walk straight into high-value internal systems. Two findings this same week, including a separate flaw in how AI coding agents verify pinned plugin code, point the same direction: the tooling around the model is becoming the attack surface.