<!-- mobian-agent-page publisher="dailydev" canonical="https://daily.dev/posts/three-researchers-hacked-openai-using-claude-opus-5-to-do-it-8yhirhsal" -->

---
title: Three researchers hacked OpenAI using Claude Opus 5 to do it
description: Three researchers chained a vulnerability in Discourse forum software with SSO token reuse to hijack OpenAI employee authentication tokens, gaining access to...
canonical: https://daily.dev/posts/three-researchers-hacked-openai-using-claude-opus-5-to-do-it-8yhirhsal
twitter:card: summary_large_image
twitter:site: @dailydotdev
og:type: website
og:site_name: daily.dev
og:title: Three researchers hacked OpenAI using Claude Opus 5 to do it | daily.dev
og:description: Three researchers chained a vulnerability in Discourse forum software with SSO token reuse to hijack OpenAI employee authentication tokens, gaining access to...
og:url: https://daily.dev/posts/three-researchers-hacked-openai-using-claude-opus-5-to-do-it-8yhirhsal
og:image: https://api.daily.dev/og/posts/8yHiRHsAL.png
og:image:alt: Three researchers hacked OpenAI using Claude Opus 5 to do it
og:image:width: 1200
og:image:height: 630
og:locale: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Three researchers hacked OpenAI using Claude Opus 5 to do it

**[Trends](https://daily.dev/sources/trends)** · 2 min read · 15 upvotes · 5 comments

## Summary

Three researchers chained a vulnerability in Discourse forum software with SSO token reuse to hijack OpenAI employee authentication tokens, gaining access to ChatGPT accounts and OpenAI's private GitHub repositories. They used Anthropic's Claude Opus 5 to assist with the attack. OpenAI says its review found only limited reads of private-repo metadata and code, with no model weights exposed. The researchers disclosed publicly the same day, confirming they could take over ChatGPT/Codex accounts belonging to employees and some regular users.

## Content

On July 25, three researchers at Hacktron AI opened a pull request against OpenAI's private monorepo. The whole thing cost under $3,000 in model tokens. OpenAI paid them $6,500 to go away.

Here's the chain: a heap buffer overflow in libheif, the image-decoding library Discourse uses for HEIC uploads, gave the researchers remote code execution on OpenAI's public community forum. The bug had already been quietly fixed upstream but never got a CVE, so Discourse's dependency sat unpatched. From there, SSO session tokens issued on the public forum turned out to be valid for high-privilege employee accounts on ChatGPT and Codex. One compromised Codex account was enough to push into the private monorepo. OpenAI says only "limited reads" of metadata and code changes happened; no model weights were exposed.

The part everyone's talking about: Claude Opus 4.8 tried and failed. It could only get the exploit working with ASLR disabled, which is useless in the real world. Then Anthropic shipped Opus 5 overnight, and within hours it had a working ARM64 exploit. In a follow-up autonomous run, Opus 5 achieved RCE against a test forum with minimal human involvement after being tricked into treating the real target as a CTF challenge.

Two months of research, under $3k in API costs, 72 hours from first access to working exploit chain. OpenAI patched the SSO flaw in 14 hours and paid the bounty through Bugcrowd.

The disclosure worked as intended. But the uncomfortable takeaway isn't that OpenAI got hacked — it's that the capability jump between Opus 4.8 and Opus 5 was the difference between a failed exploit and a successful one. Nathan Lambert's read is pointed: closed models are the tip of the iceberg on AI security risks, not open ones. The attack surface isn't the model weights sitting on Hugging Face. It's what a sufficiently capable model can do when pointed at your infrastructure by someone with $3,000 and a bug bounty account.

OpenAI has since narrowed SSO token permissions. Discourse patched the libheif dependency. The researchers got their $6,500. Everyone moves on — until the next model ships.

## Questions this post answers

### How did researchers manage to hack OpenAI in July using Discourse?

A flaw in Discourse, the forum software OpenAI uses, allowed researchers to steal authentication tokens belonging to OpenAI employees. Some tokens worked directly on ChatGPT, while others granted access to OpenAI's GitHub service through SSO token reuse, letting one compromised identity pivot across multiple internal systems.

_Security teams tracking SSO and identity-boundary risks follow incidents like this on daily.dev._

### What data was exposed when OpenAI employee accounts were compromised?

OpenAI's internal review found only limited reads of private-repository metadata and code changes, with no model weights exposed. However, the researchers confirmed they took over ChatGPT and Codex accounts belonging to OpenAI employees and some regular users, meaning attackers reached private code repositories even if the damage was contained.

_Anyone assessing the real blast radius of a breach can follow how incidents like this get scoped on daily.dev._

## Community take

How the wider developer community reacted, aggregated from 4 discussions and 17 comments across x (as of 2026-09-23).

**TL;DR:** Discussion centers on the irony of a competitor's AI helping breach OpenAI's perimeter, but most substantive replies argue the real cause was sloppy identity/token hygiene (shared auth across Discourse, ChatGPT, and GitHub) rather than the AI itself being dangerous.

**Sentiment:** 10% positive · 55% mixed · 35% skeptical

**The case for**

- The AI mainly compressed reconnaissance work into a much shorter timeframe rather than discovering a novel exploit itself.
- Some see this as useful pressure to modernize identity and access practices across legacy infrastructure.

**The pushback**

- The root cause was that forum tokens shouldn't have been valid on the main platform's API/auth domain at all.
- Concern that AI-assisted attacks are accelerating exploitation of leftover integrations and boundary-crossing bugs faster than defenses can patch them.
- Skepticism about the gap between the dramatic 'hacked OpenAI' framing and OpenAI's own characterization of only limited, non-weight-exposing reads.
- Worry that if scoped-down safety guardrails on the AI model were involved, this could be the first real-world incident testing that tradeoff.

**By community**

- x (mixed): Replies mix dark humor about a rival's model breaching OpenAI with more technical takes blaming shared/reused auth tokens across services rather than the AI itself.

**Hottest debate:** Whether the incident is really about a dangerous AI escalation or simply a mundane token/identity-hygiene failure that AI merely accelerated.

**Open questions**

- What made Discourse forum tokens valid on OpenAI's main API/GitHub authentication domain?
- Was the AI model actually running under the loosened cyber-guardrail research mode during this specific attack?
- How far did the actual access scope extend, beyond OpenAI's own characterization of 'limited reads'?

**Highlights**

> @rohanpaul_ai The real gap here: headline says 'broke into,' OpenAI's review says 'limited reads,' no weights exposed. Both can be true. The failure isn't AI running wild, it's a forum flaw crossing into ChatGPT and GitHub auth boundaries that shouldn't touch.
> — [bunnyhoneyclub on x](https://x.com/bunnyhoneyclub/status/2100820038211252647)

> @rohanpaul_ai The model did not create the hole, token reuse across forum, ChatGPT and GitHub did. AI just compressed weeks of recon into an afternoon. Which means the defence is boring identity hygiene, scoped tokens per service, not better detection of AI attackers.
> — [TanmaySaboo on x](https://x.com/TanmaySaboo/status/2100839662172721530)

> @rohanpaul_ai timing sharpens this morning's guardrail question: if the researchers were on the loosened cyber-verification builds, this is the first production incident of that debate. if they weren't, anthropic's standard safeguards just got walked around by three people and a discourse
> — [Raccoon679 on x](https://x.com/Raccoon679/status/2100823750472282594)

> @rohanpaul_ai What made the forum tokens valid on the API endpoint? Discourse and the main platform should have separate auth domains.
> — [jatingargiitk on x](https://x.com/jatingargiitk/status/2100841238140539119)

> @rohanpaul_ai so the safety lab's forum leaked its own staff tokens via a discourse chain. centralized trust remains undefeated at losing. self-host or stay npc.
> — [ZeroDay\_0X on x](https://x.com/ZeroDay_0X/status/2100827296680620121)

**Source threads**

- [x](https://x.com/transitive_bs/status/2100818528698052764) · 0 points · 0 comments
- [x](https://x.com/rohanpaul_ai/status/2100810101145891305) · 0 points · 17 comments
- [x](https://x.com/LiveOverflow/status/2100777983334023206) · 0 points · 0 comments
- [x](https://x.com/Hesamation/status/2100862421048893720) · 0 points · 0 comments

## Community discussion

Top comments from developers on daily.dev.

**@isaac0yen** · 7 upvotes

> The same Opus 5 that's doing sh*t on my codebase?

**@petecapecod** · 3 upvotes

> What?!? You just don't go hacking your competition for fun! 😤
>
> When they have no IDEA you're coming?
>
> Bro, that's a crime here in America 🚫
>
> Also where can I get access to this cool Opus 5 version? asking for a friend

**@doncho** · 1 upvotes

> The war of the AIs 😀

**@recursivelearning** · 1 upvotes

> I am unfortunately too familiar with claude speak and 'The uncomfortable detail is what made it work' is a claudism. That combined with all the em dashes makes this article read as ai generated. I myself am guilty of doing this. That being said we should stop and write from our own minds.

---

Tags: [#security](https://daily.dev/tags/security), [#openai](https://daily.dev/tags/openai), [#authentication](https://daily.dev/tags/authentication), [#claude](https://daily.dev/tags/claude)

[View this post on daily.dev](https://daily.dev/posts/three-researchers-hacked-openai-using-claude-opus-5-to-do-it-8yhirhsal)

```json
{"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]}
{"@context":"https://schema.org","@type":"TechArticle","headline":"Three researchers hacked OpenAI using Claude Opus 5 to do it","url":"https://daily.dev/posts/three-researchers-hacked-openai-using-claude-opus-5-to-do-it-8yhirhsal","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/three-researchers-hacked-openai-using-claude-opus-5-to-do-it-8yhirhsal"},"datePublished":"2026-09-18T05:26:07.391Z","dateModified":"2026-09-23T11:34:22.603Z","description":"Three researchers chained a vulnerability in Discourse forum software with SSO token reuse to hijack OpenAI employee authentication tokens, gaining access to...","isAccessibleForFree":true,"articleSection":"Trends","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Trends","logo":"https://media.daily.dev/image/upload/s--ZfSp3asX--/f_auto,q_auto/v1780996004/logos/trends?_a=BAMAMiWQ0","url":"https://daily.dev/sources/trends"},"commentCount":5,"discussionUrl":"https://daily.dev/posts/three-researchers-hacked-openai-using-claude-opus-5-to-do-it-8yhirhsal","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":15},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":5}],"keywords":"security,openai,authentication,claude","timeRequired":"PT2M"}
{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Trends","item":"https://daily.dev/sources/trends"},{"@type":"ListItem","position":3,"name":"Three researchers hacked OpenAI using Claude Opus 5 to do it"}]}
{"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/three-researchers-hacked-openai-using-claude-opus-5-to-do-it-8yhirhsal","comment":[{"@type":"Comment","text":"The same Opus 5 that’s doing sh*t on my codebase?","datePublished":"2026-09-18T08:53:31.818Z","url":"https://daily.dev/posts/8yHiRHsAL#c-vK0zklMc6","author":{"@type":"Person","name":"Oyeniyi Isaac","url":"https://daily.dev/isaac0yen","image":"https://media.daily.dev/image/upload/s--xi7tWp_S--/f_auto/v1718722675/avatars/avatar_3sVwNtK2xXTBsCb7yiWw6"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":7}},{"@type":"Comment","text":"What?!? You just don’t go hacking your competition for fun! 😤\nWhen they have no IDEA you’re coming?\nBro, that’s a crime here in America 🚫\nAlso where can I get access to this cool Opus 5 version? asking for a friend","datePublished":"2026-09-18T13:33:08.710Z","url":"https://daily.dev/posts/8yHiRHsAL#c-K9vMMl4zH","author":{"@type":"Person","name":"Peter Cruckshank","url":"https://daily.dev/petecapecod","image":"https://media.daily.dev/image/upload/s--ZJhQyKws--/f_auto/v1721235024/avatars/avatar_A9xh33q0QoxtkGoJRCosp"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":3}},{"@type":"Comment","text":"The war of the AIs 😀","datePublished":"2026-09-18T13:06:42.842Z","url":"https://daily.dev/posts/8yHiRHsAL#c-GKGlIgiXT","author":{"@type":"Person","name":"Doncho Angelov","url":"https://daily.dev/doncho","image":"https://media.daily.dev/image/upload/s--j1MSm0hy--/f_auto/v1716369534/avatars/avatar_EB0j0Umzh5v3zGWUSL5ma"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1}},{"@type":"Comment","text":"I am unfortunately too familiar with claude speak and ‘The uncomfortable detail is what made it work’ is a claudism. That combined with all the em dashes makes this article read as ai generated. I myself am guilty of doing this. That being said we should stop and write from our own minds.","datePublished":"2026-09-20T17:03:23.716Z","url":"https://daily.dev/posts/8yHiRHsAL#c-rgnLOyQii","author":{"@type":"Person","name":"recursiveLearning","url":"https://daily.dev/recursivelearning","image":"https://media.daily.dev/image/upload/s--PRRU42N6--/f_auto/v1741235762/avatars/avatar_ygM78lAtO9B9bHFUcEVHC"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1}}]}
{"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/three-researchers-hacked-openai-using-claude-opus-5-to-do-it-8yhirhsal#faq","mainEntity":[{"@type":"Question","name":"How did researchers manage to hack OpenAI in July using Discourse?","acceptedAnswer":{"@type":"Answer","text":"A flaw in Discourse, the forum software OpenAI uses, allowed researchers to steal authentication tokens belonging to OpenAI employees. Some tokens worked directly on ChatGPT, while others granted access to OpenAI's GitHub service through SSO token reuse, letting one compromised identity pivot across multiple internal systems. Security teams tracking SSO and identity-boundary risks follow incidents like this on daily.dev."}},{"@type":"Question","name":"What data was exposed when OpenAI employee accounts were compromised?","acceptedAnswer":{"@type":"Answer","text":"OpenAI's internal review found only limited reads of private-repository metadata and code changes, with no model weights exposed. However, the researchers confirmed they took over ChatGPT and Codex accounts belonging to OpenAI employees and some regular users, meaning attackers reached private code repositories even if the damage was contained. Anyone assessing the real blast radius of a breach can follow how incidents like this get scoped on daily.dev."}}]}
```