Security researchers from Hacktron successfully compromised OpenAI employee accounts and internal code repositories in July 2026 by using Claude Opus 5 to chain a remote code execution vulnerability in OpenAI’s public help forum with a weakness in their Single Sign-On system. The incident resulted in a $6,500 bug bounty.
Hacktron researchers compromise OpenAI accounts using AI-augmented exploit
In late July 2026, an authorized security audit conducted by Hacktron researchers laid bare how peripheral corporate infrastructure can act as a direct gateway to critical internal assets. By leveraging cutting-edge machine learning model capabilities, the research team bypassed enterprise perimeter defenses without touching customer data or merging production code.
Targeting CVE-2026-32882 on the public Discourse help forum
The intrusion vector began on the evening of July 24, 2026, targeting OpenAI’s public-facing Discourse help forum. This library was actively deployed by the forum’s ImageMagick implementation to handle user-uploaded HEIC and HEIF image assets.
Writing raw memory corruption exploits typically demands meticulous manual craftsmanship, especially when defeating modern mitigations like Address Space Layout Randomization. This is where AI-augmented exploitation changed the operational timeline. The researchers utilized Claude Opus 5 to rapidly generate a working exploit capable of navigating these structural hurdles. The model’s capacity to synthesize complex payload logic drastically accelerated the discovery-to-execution window.
Single Sign-On centralization and lateral movement
Once the Discourse server environment fell, the lateral movement phase began. The attack mechanism relied directly on identity centralization and trust relationships within the corporate ecosystem. By seizing control of the public forum server, the researchers targeted the “Sign in with OpenAI” Single Sign-On mechanism.
Because OpenAI employees used the identical identity provider credentials to authenticate against the public help forum and internal development tools, the compromise did not require manual user interaction or credential stuffing. The session tokens generated from the forum server IP address granted immediate administrative leverage to pivot directly into employee ChatGPT and Codex environments.
Deep repository access and rapid remediation
The technical reach of the breached session tokens extended deep into the infrastructure. While the exploit successfully navigated to internal OpenAI code repositories via Codex—triggering a harmless proof-of-concept pull request to verify access—the underlying permissions structure left wide avenues unexplored. According to the investigation, the integrated service permissions could have theoretically unlocked access to internal Slack instances, GitHub organizations, and corporate email systems, though those vectors remained untouched.
Speed defined the remediation lifecycle. OpenAI security teams detected the anomalous activity and patched the login flaw approximately 14 hours after receiving the vulnerability disclosure report. Hacktron formally submitted the findings through OpenAI’s bug bounty program, earning a $6,500 payout finalized on September 1, 2026. The impacted Discourse server environment required immediate administrative remediation, including updating libheif to version 1.22.0 or higher to eliminate the underlying memory corruption vector.
The broader security implications for AI enterprises
Automated exploit generation lowers the technical barrier for discovering and chaining complex software vulnerabilities.
