AI Hallucination Flaw Exposes OpenAI Forum to Account Takeovers

Key Takeaways

• Security researchers exploited an image-processing vulnerability in OpenAI’s community forum, leading to remote code execution.
• The breach leveraged a flaw in OpenAI’s single sign-on, allowing account takeovers of employee ChatGPT and Codex accounts.
• Anthropic’s Claude Opus 5 significantly accelerated the exploit development process, creating a working exploit in just three hours.
• The vulnerability, CVE-2026-32882, stemmed from an outdated libheif package in Discourse and a heap-buffer overflow.
• OpenAI fixed the identity misconfiguration within 14 hours, while Discourse issued a patch for the image processing vulnerability.

A sophisticated attack chain, facilitated by advanced AI, successfully compromised OpenAI’s community forum, leading to account takeovers of employee ChatGPT and Codex accounts and access to an internal source-code repository. The operation, conducted on July 25, 2026, by researchers at Hacktron, highlighted critical vulnerabilities in both the forum’s image processing and OpenAI’s single sign-on system.

The incident demonstrates how a security lapse in a peripheral service can propagate across identity boundaries, ultimately threatening high-value AI development environments. The researchers utilized Anthropic’s Claude Opus 5 to expedite the weaponization of an image-decoder vulnerability, showcasing AI’s growing role in offensive security.

The Attack Vector: Image Processing Flaw

The initial breach originated in community.openai.com, OpenAI’s help forum built on the Discourse platform. Hacktron researchers Harsh Jaiswal, Mohan Pedhapati, and Rahul Maini meticulously analyzed the forum’s image upload pipeline. They discovered that HEIC and HEIF image formats bypassed the standard FastImage validation routines because the library lacked support for these newer formats. Instead, Discourse invoked ImageMagick’s magick utility, which then exposed the underlying libheif parser to potentially malicious image data.

Hacktron identified that the Debian package installed on the Discourse instance was missing an upstream security patch. This left a heap-buffer overflow vulnerability in libheif, which provided out-of-bounds read-and-write primitives during HEIC decoding. The Discourse Docker image utilized Debian 12 with libheif version 1.19.7, while Debian 13 had already shipped version 1.19.8. Debian later issued DSA-6417-1, warning that CVE-2026-32882 and related libheif issues could lead to denial of service, memory disclosure, or even arbitrary code execution when processing malformed images.

AI Accelerates Exploit Development

A notable aspect of this operation was the significant role played by Anthropic’s Claude Opus AI models in exploit development. Initially, Hacktron tasked Claude Opus 4.8 with auditing the vulnerable package and constructing an exploit. While Opus 4.8 reportedly achieved code execution when Address Space Layout Randomization (ASLR) was disabled, it struggled to produce a reliably stable exploit under Discourse’s default ASLR-enabled configuration.

Following the release of Claude Opus 5 on July 24, the researchers presented the same challenge to the updated model. According to Hacktron, Opus 5 successfully generated a functional ARM64 exploit for a local Mac system within a mere three hours. The researchers then adapted this exploit to Discourse’s x86-64 architecture and jemalloc environment.

By 6:00 UTC on July 25, the team had confirmed local Remote Code Execution (RCE) via an image upload. Subsequent testing against their own proxied Discourse Cloud instance allowed them to retrieve /etc/hosts, after which the generated exploit was deployed against OpenAI’s forum.

The researchers emphasized that this was not fully autonomous hacking. Human oversight remained crucial for directing sessions, validating results, and managing the disclosure process. However, the AI’s contribution dramatically condensed the exploit engineering timeline, a process that traditionally demands substantially more time and specialized human expertise.

Escalation to OpenAI Systems

Achieving RCE on the forum alone did not grant direct access to OpenAI’s internal monorepo. Hacktron discovered a distinct misconfiguration in OpenAI’s identity management system that allowed a compromised forum session to facilitate a no-interaction takeover of ChatGPT and Codex accounts belonging to active members. This critical flaw underscored the importance of thoroughly reviewing federated identity trust across all connected applications.

The potential blast radius extended beyond the forum itself because these compromised accounts could link to other services like GitHub, Slack, and email. To demonstrate their access without directly reviewing internal source code, the researchers instructed an affected employee’s Codex account, which was connected to OpenAI’s GitHub organization, to open a harmless pull request (number 1186742) in the private openai/openai monorepo. Following this proof of concept, they ceased testing, updated their Bugcrowd report, and promptly notified OpenAI’s security team.

The Wall Street Journal independently corroborated that the Claude-assisted researchers successfully accessed an employee’s ChatGPT account and could propose modifications to a confidential repository.

Disclosure and Remediation

Hacktron reported the OpenAI-side chain between 08:00 and 10:00 UTC on July 25. OpenAI swiftly confirmed a fix by 22:49:45 UTC, approximately 14 hours after the initial report. OpenAI later awarded $6,500 for the finding related to their identity misconfiguration, noting that testing community.openai.com itself was outside the scope of their bug bounty program.

Discourse received a separate HackerOne report, responded on Sunday, developed a fix by Monday, and published GHSA-vhm9-85gw-x335 on July 28, addressing the image processing vulnerability.

What You Should Do

• Discourse Operators: Self-hosted Discourse operators must pull the latest code and rebuild their application containers. A simple web-interface update may not replace the vulnerable base image.
• Image Processing Organizations: Organizations that process untrusted HEIF, HEIC, or AVIF files should immediately install security-patched libheif and libde265 packages. It is also recommended to disable unnecessary decoders and isolate image conversion processes within hardened, ephemeral sandboxes.
• ImageMagick Users: ImageMagick advises restricting deployments to only required formats, such as GIF, JPEG, and PNG, by configuring its security policy.
• Identity Management Review: All organizations utilizing federated identity trust across connected applications should conduct thorough reviews of their identity configurations to prevent peripheral service breaches from escalating into core systems.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.