Quick Answer
Researchers say Claude helped them find and exploit weaknesses that led to multiple OpenAI employees’ ChatGPT and Codex accounts on July 25, 2026. The disclosed chain began with a high-severity Discourse flaw and ended with access to an internal repository. OpenAI says it revoked affected sessions and narrowed token permissions. Organizations should patch Discourse and review single-sign-on token scope.
Key Takeaways
- Researchers say the attack chain reached multiple OpenAI employee accounts on July 25, 2026.
- The initial flaw was CVE-2026-32882, a high-severity HEIF upload vulnerability in Discourse.
- Hacktron says Claude Opus 4.8 found missing security backports, while Claude Opus 5 helped develop an exploit.
- The researchers demonstrated repository access by creating harmless internal pull request #1186742.
- OpenAI says it revoked affected sessions and reduced Community sign-in-token permissions.
What happened in the Claude-assisted OpenAI breach?
The Claude-assisted OpenAI breach was a responsible-disclosure security demonstration that researchers say reached multiple OpenAI employees’ ChatGPT and Codex accounts on July 25, 2026. The researchers, writing under the Hacktron AI name, say the exploit chain began with remote code execution in OpenAI’s Discourse-hosted community forum and then used a flaw involving OpenAI single sign-on identity access.
The researchers say the chain ultimately reached OpenAI’s internal source-code environment. To demonstrate that access without examining sensitive code, they used a connected employee Codex account to create harmless pull request #1186742 in OpenAI’s internal openai/openai monorepo. Hacktron AI’s technical disclosure says the researchers reported the issue after identifying the path to repository access.
The important distinction is that the disclosure describes a chain of weaknesses rather than a single failure by Claude or OpenAI. The researchers used an AI system as part of security research, while the reported access depended on an exposed software vulnerability and identity-token permissions. Organizations using AI coding tools should treat generated exploit development as an additional reason to patch internet-facing software quickly and to limit the authority attached to sign-in tokens.
How did the attack chain reach OpenAI employee accounts?
The reported attack chain started with a vulnerable image upload path in Discourse, the forum software OpenAI used for its community site. Hacktron says remote code execution on the forum gave the researchers an initial position from which they could pursue the OpenAI single-sign-on path connected to ChatGPT and Codex accounts.
The identity step matters because a compromised forum does not automatically provide access to separate corporate services. The researchers say an OpenAI-side single-sign-on identity flaw allowed the forum compromise to cross into employee accounts. That design issue turns a breach of one service into a broader account-access problem when tokens or trusted identity relationships have more permissions than necessary.
OpenAI told The Wall Street Journal that it narrowed Community sign-in-token permissions and revoked affected tokens and sessions. CBS News reported OpenAI’s response on September 18, 2026. The practical response for companies is to inventory which applications can issue or exchange single-sign-on tokens, then restrict each token to the minimum services and actions required.
What role did Claude play in the security research?
Claude played a supporting role in the researchers’ claimed exploit-development process, according to Hacktron’s disclosure. The researchers say Claude Opus 4.8 identified missing libheif security backports, while Claude Opus 5 helped produce a working exploit for the target x86-64 and jemalloc configuration.
The Claude role does not establish that an AI model independently breached OpenAI or made security decisions without human direction. The disclosure attributes the research decisions, target selection, validation, and responsible reporting to the researchers. AI systems can speed up code analysis and technical experimentation, but human operators still determine whether to test, deploy, disclose, or misuse the resulting work.
This distinction matters because the same capabilities that help defenders analyze patches can help researchers understand vulnerable configurations. Security teams should account for faster exploit development when prioritizing patches. The recent Gemini security test also illustrates why organizations need clear safeguards when AI systems are used in controlled security work.
Which Discourse vulnerability was involved?
The underlying Discourse vulnerability was CVE-2026-32882, a high-severity HEIF-upload remote-code-execution flaw with a CVSS score of 8.8. Discourse published advisory GHSA-vhm9-85gw-x335 on July 28, 2026, and listed patched releases 2026.7.0, 2026.6.1, 2026.5.2, and 2026.1.6.
Remote code execution means an attacker can run code on a vulnerable server through a flaw in the application’s handling of untrusted data. In this case, the affected path involved HEIF image uploads. That is particularly serious for public forums because upload features commonly accept content from users outside an organization’s trusted network.
Hacktron says the vulnerable Discourse Docker image used libheif 1.19.7 and that libheif 1.23.4 was the current upstream security release as of September 14. Discourse’s security advisory identifies the affected software and patched release lines. Administrators should update to an applicable patched Discourse version and confirm that container images do not retain older vulnerable dependencies.
| Attack-chain stage | Reported issue or action | Why it mattered | Practical response |
|---|---|---|---|
| Initial access | CVE-2026-32882 in Discourse HEIF uploads | Remote code execution could expose the forum server. | Install a patched Discourse release. |
| Dependency exposure | Missing libheif security backports, according to Hacktron | Older image-processing components can preserve known weaknesses. | Review container images and dependency versions. |
| Identity access | OpenAI single-sign-on identity flaw, according to Hacktron | Forum access could extend to employee service accounts. | Restrict token scopes and trusted application relationships. |
| Containment | Tokens and sessions revoked by OpenAI | Revocation reduces continued use of affected credentials. | Force reauthentication and investigate token issuance logs. |
Why did internal repository access matter?
Internal repository access mattered because source repositories can contain proprietary code, development history, configuration references, and connections to other engineering systems. Hacktron says the researchers avoided reading sensitive code and instead created harmless pull request #1186742 to prove the access path.
The limited demonstration reduced the immediate exposure described in the disclosure, but it does not make the underlying access issue minor. An account that can create a pull request may have permissions that affect code review, build processes, or internal collaboration workflows. The safe assumption is that repository access through an employee identity requires immediate containment and a careful audit.
OpenAI’s reported revocation of affected sessions and tokens addresses the active access path, but organizations should also examine whether compromised identities used connected developer tools. The concern is broader than source code alone. As OpenAI’s model-safety reporting has shown in a different context, access controls and oversight remain important when powerful systems interact with internal files and workflows.
What did OpenAI do after the disclosure?
OpenAI revoked affected tokens and sessions and narrowed permissions for Community sign-in tokens, according to the company’s response reported on September 18, 2026. Those actions address two immediate risks: continued use of credentials that may have been exposed and overly broad access granted through the Community sign-in connection.
Hacktron says OpenAI paid a $6,500 bug-bounty award after fixing the OpenAI-side issue. The researchers also say the time from their initial vulnerability discovery to OpenAI repository access was less than 72 hours. The short reported timeline shows why organizations cannot rely only on long patch cycles when a public-facing service connects to internal identity systems.
OpenAI’s remediation does not remove the broader lesson for other companies. A security program needs to treat forums, help centers, developer portals, and other public services as possible entry points when they share authentication infrastructure with employee tools. The most sensible approach is to separate trust boundaries, minimize token authority, and make revocation fast enough to use during an active incident.
How should organizations respond to similar risks?
Organizations should patch exposed software, reduce single-sign-on token scope, and verify which external applications can reach internal services. The reported OpenAI chain combined a server-side flaw with an identity-permission issue, so fixing only the initial vulnerability would not fully address the risk.
- Update Discourse and related container images to a patched release, then confirm the deployed version rather than assuming an update completed.
- Review image-upload handling and identify software dependencies that process untrusted files, including HEIF libraries.
- Restrict single-sign-on tokens to specific services, actions, and time periods instead of granting broad account access.
- Revoke and rotate affected tokens after suspected exposure, then review authentication and repository activity for unusual behavior.
- Test incident-response procedures with a security team before an active compromise forces rushed changes.
Organizations should stop and contact their security vendor or incident-response provider if logs suggest unauthorized account access, unexpected token issuance, or repository actions that administrators cannot explain. Internal teams should not delete evidence or broadly reconfigure identity systems during an active incident without a containment plan, because those actions can make investigation more difficult.
Consumers are not directly responsible for patching enterprise forum software, but the incident reinforces the value of separating personal accounts from workplace identities. Users should also remain cautious around AI-branded services, especially when account permissions or wallet access are requested, because fake AI trading tools can use familiar technology language to disguise credential and malware risks.
FAQ
Did Claude hack OpenAI by itself?
Claude did not hack OpenAI by itself, based on the disclosed account. Hacktron says human researchers used Claude to help identify missing security backports and develop an exploit, while the researchers conducted and reported the security testing.
What vulnerability was used in the OpenAI attack chain?
The reported initial vulnerability was CVE-2026-32882, a Discourse HEIF-upload remote-code-execution flaw rated CVSS 8.8. Discourse lists patched releases including 2026.7.0, 2026.6.1, 2026.5.2, and 2026.1.6.
Were OpenAI’s internal code repositories accessed?
Hacktron says an employee’s connected Codex account was used to access OpenAI’s internal openai/openai monorepo. The researchers say they created harmless pull request #1186742 rather than reading sensitive source code.
What did OpenAI do after the reported breach?
OpenAI revoked affected tokens and sessions and narrowed Community sign-in-token permissions. Those measures are intended to prevent continued use of the affected authentication path.
What should Discourse administrators do?
Discourse administrators should install a patched release and review deployed container dependencies, especially libheif versions. Security teams should also review whether forum identities or tokens can reach employee services with unnecessary permissions.