Researchers Used Claude AI to Chain Vulnerabilities in OpenAI Systems
Security team demonstrates how AI can accelerate discovery of critical chained vulnerabilities
1Chained vulnerabilities exposed
Security researchers at Hacktron discovered a critical chain of vulnerabilities affecting OpenAI systems. They first exploited a memory corruption flaw in libheif (CVE-2026-32882) through specially crafted HEIC/HEIF images uploaded to OpenAI's public Discourse forum. This allowed remote code execution on the forum server. From there, they leveraged OpenAI's single sign-on (SSO) system to gain access to employee ChatGPT and Codex accounts. The entire chain was executed within 72 hours, demonstrating how seemingly separate vulnerabilities can combine for serious breaches.
2AI-powered exploit development
The research team used Anthropic's Claude Opus 5 AI to develop the working exploit. Initial attempts with Claude Opus 4.8 failed when ASLR (Address Space Layout Randomization) protections were enabled. However, the newer Opus 5 model successfully created a working exploit within hours of its release on July 24, 2026. The researchers circumvented Claude's safeguards by framing the target as a capture-the-flag practice server. This case highlights how advanced AI models are dramatically reducing the time and skill required for sophisticated offensive security work.
3Limited but concerning access
Through their exploit chain, the researchers gained access to an internal OpenAI code repository but maintained strict ethical boundaries. They created a single harmless pull request to demonstrate access without reading source code, merging changes, or accessing customer data. The potential reach was much broader - employee accounts connected to services like GitHub, Slack, and email could have been compromised. OpenAI fixed the SSO vulnerability within 14 hours of receiving the report and paid a $6,500 bounty for the discovery.
4Underlying technical flaws
The vulnerability chain began with an out-of-bounds read in libheif (version 1.19.7) that could leak memory contents. The researchers, with AI assistance, escalated this to full remote code execution by defeating ASLR protections. While libheif had been patched in version 1.22.0 (May 2026), OpenAI's forum server was still running the vulnerable version in July. Discourse-hosted instances were protected, but self-hosted servers needed manual updates to versions 2026.7.0 or later to receive the fix.
5Broader campaign findings
This was part of Hacktron's larger 'HEIF Heist' project that identified similar image-decoding vulnerabilities across multiple platforms. Using AI tools (including OpenAI's GPT-5.6 Sol), they found flaws in software used by Slack, Meta, GitHub Enterprise, and Next.js at minimal cost ($3,000 in AI usage over two months). While some findings were confirmed (Next.js by Vercel, Meta-related bugs by libheif maintainers), others remain unverified. Only Shopify appeared to notice the testing activity despite thousands of crash-inducing test uploads.
6Systemic security implications
The incident reveals two critical security weaknesses: outdated dependencies in production systems and overreliance on shared authentication. Services using libheif for HEIC/HEIF/AVIF processing remain vulnerable if not updated. More concerning is how a breach in a low-trust public service (like a forum) can compromise all connected high-trust systems through shared SSO. This pattern extends beyond OpenAI - any organization using similar authentication architectures faces comparable risks.
7AI's dual-edge in security
This case demonstrates AI's growing role in both offensive and defensive security. While attackers use models like Claude to accelerate vulnerability discovery and exploit development, defenders struggle with visibility and control over AI agents accessing sensitive systems. Anthropic reports criminal and state-backed groups already using Claude models for real intrusions. The speed of AI-assisted attacks (hours vs. weeks) is outpacing traditional defense mechanisms, creating new challenges for security teams.
8Unanswered security questions
Key questions remain unresolved following this research. Organizations must determine whether to investigate for potential prior access after patching vulnerabilities. There's also limited visibility into how widely AI-assisted attacks are occurring - Shopify was the only company that detected the testing activity. As AI capabilities advance, the security community lacks standardized frameworks to assess and mitigate risks from AI-powered offensive security research and actual attacks.