Researchers say Claude helped them reach OpenAI’s private code repository

Security researchers say Anthropic’s Claude helped them exploit an image-upload flaw in OpenAI’s community forum. They then chained that access to overly broad sign-in permissions, reached one employee’s ChatGPT and Codex account, and used the employee’s GitHub-connected Codex to submit a documentation pull request to OpenAI’s private monorepo. It was never merged.

OpenAI confirmed both vulnerabilities and said both were fixed. According to Hacktron’s September 13 account, Claude Opus 4.8 stalled while trying to defeat a common memory protection, but Opus 5 produced working exploit code within hours of its July 24 release. It is a striking before-and-after result, but not a controlled test of the model upgrade.

• July 23 to 24Hacktron says Opus 4.8 identified missing security fixes and helped produce an exploit, but repeated attempts stalled with memory randomization enabled.
• July 24 to 25Anthropic released Opus 5. Hacktron says the new model produced a local ARM64 exploit within three hours and adapted it to Discourse’s x86-64 environment by the next morning.
• July 25The researchers reported the flaws to OpenAI and Discourse, demonstrated the private-repository path and stopped testing. Hacktron says OpenAI confirmed the OpenAI-side fix that evening.
• July 28Discourse published its security advisory with patch and rebuild guidance.

The entry point was community.openai.com, which runs on the forum platform Discourse. Certain image uploads were passed through ImageMagick and libheif, a library that decodes image files. A malformed HEIF image could exploit a memory-handling flaw and make the server run an attacker’s code. Discourse’s advisory independently confirms the vulnerability, CVE-2026-32882, and rates it 8.8 out of 10.

That remote code execution exposed the forum. A separate OpenAI identity flaw extended the reach. OpenAI told the Wall Street Journal, in a report syndicated by Mint, that Community sign-in tokens carried more permissions than the forum needed. Credentials available through the compromised forum could therefore reach other OpenAI services.

One employee’s Codex account was connected to GitHub. Hacktron says the researchers prompted Codex to open a pull request, which is a proposed change awaiting review, in OpenAI’s internal repository. The Journal reports that the proposal changed documentation and was not accepted. The demonstration established an ability to submit a change, not to merge one.

Hacktron says it took over multiple employee accounts, but independent reporting establishes an employee-account path without confirming that count. The researchers told the Guardian they did not download repository code. OpenAI’s review, reported by the Journal, found limited reads of private-repository metadata and code changes. The public record does not establish wholesale source-code theft, persistent access or access to model weights.

The model’s reported contribution was overcoming a practical obstacle. Address space layout randomization, or ASLR, makes memory locations less predictable and complicates attacks that depend on finding particular data. Opus 4.8 had helped produce an exploit only with ASLR disabled. After Anthropic released Opus 5, Hacktron says the new model generated a working ARM64 exploit within three hours and adapted it to Discourse’s x86-64 environment by the next morning. Humans then used the generated script against OpenAI’s forum.

The comparison remains uncontrolled. Hacktron has not published matched prompts, computing budgets, attempt counts or transcripts that would let outsiders separate the model upgrade from prior work and human guidance. Model attribution beyond exploit development is also unresolved. The Guardian reports that the team largely used GPT-5.6 Sol to carry out the hack, while Hacktron places Sol’s contribution in its broader research campaign. The available accounts do not reconcile the difference.

Two other limits concern reproducibility and authorization. The Journal reports that Hacktron had a special Opus 4.8 version for qualified security researchers, while Anthropic says its Cyber Verification Program provides Opus 5 with fewer restrictions. Hacktron says Opus initially refused to work against a remote instance, then proceeded after the researchers made their own instance appear to be a security contest target. OpenAI paid $6,500 for the OpenAI-side finding, but said testing against the Discourse-hosted forum was excluded from its bounty program. Responsible disclosure and a reward do not establish authorization for every action in the chain.

OpenAI says it narrowed token permissions and revoked affected tokens and sessions. Discourse patched its software and added isolation around image processing. Those fixes address two different points in the same chain: making hostile files harder to turn into server access, and ensuring a compromised forum credential cannot reach much farther than the forum. As coding assistants gain more connections to private systems, limiting what each login can authorize becomes a core security boundary.