Researchers Use Claude Opus 5 to Take Over OpenAI Employee ChatGPT and Codex Accounts Through Its Discourse Forum (CVE-2026-32882)

OpenAI's community forum running Discourse, OpenAI's single sign-on, and through them employee ChatGPT and Codex accounts and an internal GitHub repository

A three-person team at Hacktron disclosed on September 19, 2026 a chain that started with CVE-2026-32882 (CVSS 8.8), a flaw in the libheif HEIC/HEIF image library, used for remote code execution on OpenAI's Discourse forum, and continued through a weakness in OpenAI's SSO configuration to take over the ChatGPT and Codex accounts of multiple OpenAI employees. From there they reached an internal GitHub repository, where they opened a single pull request; they did not read or merge code or touch customer data, but note that staff accounts connected to GitHub, Slack, and email could in principle have been reached. The path from first access to the internal repository took under 72 hours. Claude Opus 4.8 had repeatedly failed to get past ASLR on the image flaw; Claude Opus 5, released July 24, produced working exploit code on a test server within hours, though the researchers say human direction was still essential. OpenAI fixed the issue within 14 hours of the report and paid a $6,500 bounty on September 1. Hacktron's framing: it was "an OpenAI identity problem, not a flaw in the forum software"

A public forum trusted by the corporate identity provider, so code execution on a peripheral web app turned into sessions on employee AI accounts that themselves carry connected-app access. The model's contribution was the exploit engineering step that previously stalled