--- title: Three researchers hacked OpenAI using Claude Opus 5 to do it description: Three researchers chained a vulnerability in Discourse forum software with SSO token reuse to hijack OpenAI employee authentication tokens, gaining access to... canonical: https://daily.dev/posts/three-researchers-hacked-openai-using-claude-opus-5-to-do-it-8yhirhsal twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Three researchers hacked OpenAI using Claude Opus 5 to do it | daily.dev og:description: Three researchers chained a vulnerability in Discourse forum software with SSO token reuse to hijack OpenAI employee authentication tokens, gaining access to... og:url: https://daily.dev/posts/three-researchers-hacked-openai-using-claude-opus-5-to-do-it-8yhirhsal og:image: https://api.daily.dev/og/posts/8yHiRHsAL.png og:image:alt: Three researchers hacked OpenAI using Claude Opus 5 to do it og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Three researchers hacked OpenAI using Claude Opus 5 to do it **[Trends](https://daily.dev/sources/trends)** · 2 min read · 7 upvotes · 4 comments ## Summary Three researchers chained a vulnerability in Discourse forum software with SSO token reuse to hijack OpenAI employee authentication tokens, gaining access to ChatGPT accounts and OpenAI's private GitHub repositories. They used Anthropic's Claude Opus 5 to assist with the attack. OpenAI says its review found only limited reads of private-repo metadata and code, with no model weights exposed. The researchers disclosed publicly the same day, confirming they could take over ChatGPT/Codex accounts belonging to employees and some regular users. ## Content On July 25, three researchers from Hacktron AI hacked OpenAI. The bounty was $6,500. The fix took 14 hours. The uncomfortable detail is what made it work: Anthropic's Claude Opus 5, released the same evening the attack succeeded. Here's the chain. Hacktron found a heap buffer overflow in libheif, the image-decoding library behind OpenAI's public Discourse forum. The bug had already been quietly fixed by libheif's maintainers but never assigned a CVE, so Discourse's dependency sat unpatched. Triggering it via HEIC image uploads gave them remote code execution on the forum server. From there, they found that SSO session tokens issued on the public forum stayed valid for high-privilege employee accounts on ChatGPT and Codex. One compromised Codex account later, they had a pull request open inside OpenAI's private monorepo. Neither vulnerability is AI-specific. What changed was the speed. Claude Opus 4.8 tried and failed to build a working exploit — it could only get RCE with ASLR disabled, which is basically a practice dummy. Opus 5 shipped overnight and produced a functional ARM64 exploit within hours. In a follow-up autonomous run, it achieved RCE against a test forum with minimal human involvement after being tricked into treating the real target as a CTF exercise. The entire two-month project across multiple platforms cost under $3,000 in model tokens. Nate Lambert's read is pointed: "closed models continue to be the tip of the iceberg on AI risks, not open models." The implication being that the capability jump from 4.8 to 5 — the exact jump that turned a failed exploit into a working one — happened inside Anthropic's walls, with loosened cyber-guardrails for security research use cases. OpenAI confirmed only "limited reads" of private repo metadata and code changes. No model weights exposed. Sessions revoked, SSO permissions narrowed, Discourse patched. The disclosure worked as intended. But the meta-story is harder to dismiss: a model released on a Tuesday evening made a previously-impossible exploit possible by Wednesday morning. The barrier to sophisticated exploit development didn't just lower — it dropped overnight, literally. ## Questions this post answers ### How did researchers manage to hack OpenAI in July using Discourse? A flaw in Discourse, the forum software OpenAI uses, allowed researchers to steal authentication tokens belonging to OpenAI employees. Some tokens worked directly on ChatGPT, while others granted access to OpenAI's GitHub service through SSO token reuse, letting one compromised identity pivot across multiple internal systems. _Security teams tracking SSO and identity-boundary risks follow incidents like this on daily.dev._ ### What data was exposed when OpenAI employee accounts were compromised? OpenAI's internal review found only limited reads of private-repository metadata and code changes, with no model weights exposed. However, the researchers confirmed they took over ChatGPT and Codex accounts belonging to OpenAI employees and some regular users, meaning attackers reached private code repositories even if the damage was contained. _Anyone assessing the real blast radius of a breach can follow how incidents like this get scoped on daily.dev._ ## Community take How the wider developer community reacted, aggregated from 4 discussions and 17 comments across x (as of 2026-09-19). **TL;DR:** Discussion centers on the irony of a competitor's AI helping breach OpenAI's perimeter, but most substantive replies argue the real cause was sloppy identity/token hygiene (shared auth across Discourse, ChatGPT, and GitHub) rather than the AI itself being dangerous. **Sentiment:** 10% positive · 55% mixed · 35% skeptical **The case for** - The AI mainly compressed reconnaissance work into a much shorter timeframe rather than discovering a novel exploit itself. - Some see this as useful pressure to modernize identity and access practices across legacy infrastructure. **The pushback** - The root cause was that forum tokens shouldn't have been valid on the main platform's API/auth domain at all. - Concern that AI-assisted attacks are accelerating exploitation of leftover integrations and boundary-crossing bugs faster than defenses can patch them. - Skepticism about the gap between the dramatic 'hacked OpenAI' framing and OpenAI's own characterization of only limited, non-weight-exposing reads. - Worry that if scoped-down safety guardrails on the AI model were involved, this could be the first real-world incident testing that tradeoff. **By community** - x (mixed): Replies mix dark humor about a rival's model breaching OpenAI with more technical takes blaming shared/reused auth tokens across services rather than the AI itself. **Hottest debate:** Whether the incident is really about a dangerous AI escalation or simply a mundane token/identity-hygiene failure that AI merely accelerated. **Open questions** - What made Discourse forum tokens valid on OpenAI's main API/GitHub authentication domain? - Was the AI model actually running under the loosened cyber-guardrail research mode during this specific attack? - How far did the actual access scope extend, beyond OpenAI's own characterization of 'limited reads'? **Highlights** > @rohanpaul_ai The real gap here: headline says 'broke into,' OpenAI's review says 'limited reads,' no weights exposed. Both can be true. The failure isn't AI running wild, it's a forum flaw crossing into ChatGPT and GitHub auth boundaries that shouldn't touch. > — [bunnyhoneyclub on x](https://x.com/bunnyhoneyclub/status/2100820038211252647) > @rohanpaul_ai The model did not create the hole, token reuse across forum, ChatGPT and GitHub did. AI just compressed weeks of recon into an afternoon. Which means the defence is boring identity hygiene, scoped tokens per service, not better detection of AI attackers. > — [TanmaySaboo on x](https://x.com/TanmaySaboo/status/2100839662172721530) > @rohanpaul_ai timing sharpens this morning's guardrail question: if the researchers were on the loosened cyber-verification builds, this is the first production incident of that debate. if they weren't, anthropic's standard safeguards just got walked around by three people and a discourse > — [Raccoon679 on x](https://x.com/Raccoon679/status/2100823750472282594) > @rohanpaul_ai What made the forum tokens valid on the API endpoint? Discourse and the main platform should have separate auth domains. > — [jatingargiitk on x](https://x.com/jatingargiitk/status/2100841238140539119) > @rohanpaul_ai so the safety lab's forum leaked its own staff tokens via a discourse chain. centralized trust remains undefeated at losing. self-host or stay npc. > — [ZeroDay\_0X on x](https://x.com/ZeroDay_0X/status/2100827296680620121) **Source threads** - [x](https://x.com/transitive_bs/status/2100818528698052764) · 0 points · 0 comments - [x](https://x.com/rohanpaul_ai/status/2100810101145891305) · 0 points · 17 comments - [x](https://x.com/LiveOverflow/status/2100777983334023206) · 0 points · 0 comments - [x](https://x.com/Hesamation/status/2100862421048893720) · 0 points · 0 comments ## Community discussion Top comments from developers on daily.dev. **@petecapecod** · 2 upvotes > What?!? You just don't go hacking your competition for fun! 😤 > > When they have no IDEA you're coming? > > Bro, that's a crime here in America 🚫 > > Also where can I get access to this cool Opus 5 version? asking for a friend **@isaac0yen** · 2 upvotes > The same Opus 5 that's doing sh*t on my codebase? **@doncho** · 0 upvotes > The war of the AIs 😀 --- Tags: [#security](https://daily.dev/tags/security), [#openai](https://daily.dev/tags/openai), [#authentication](https://daily.dev/tags/authentication), [#claude](https://daily.dev/tags/claude) [View this post on daily.dev](https://daily.dev/posts/three-researchers-hacked-openai-using-claude-opus-5-to-do-it-8yhirhsal) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Three researchers hacked OpenAI using Claude Opus 5 to do it","url":"https://daily.dev/posts/three-researchers-hacked-openai-using-claude-opus-5-to-do-it-8yhirhsal","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/three-researchers-hacked-openai-using-claude-opus-5-to-do-it-8yhirhsal"},"datePublished":"2026-09-18T05:26:07.391Z","dateModified":"2026-09-19T06:39:46.911Z","description":"Three researchers chained a vulnerability in Discourse forum software with SSO token reuse to hijack OpenAI employee authentication tokens, gaining access to...","isAccessibleForFree":true,"articleSection":"Trends","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Trends","logo":"https://media.daily.dev/image/upload/s--ZfSp3asX--/f_auto,q_auto/v1780996004/logos/trends?_a=BAMAMiWQ0","url":"https://daily.dev/sources/trends"},"commentCount":4,"discussionUrl":"https://daily.dev/posts/three-researchers-hacked-openai-using-claude-opus-5-to-do-it-8yhirhsal","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":7},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":4}],"keywords":"security,openai,authentication,claude","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Trends","item":"https://daily.dev/sources/trends"},{"@type":"ListItem","position":3,"name":"Three researchers hacked OpenAI using Claude Opus 5 to do it"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/three-researchers-hacked-openai-using-claude-opus-5-to-do-it-8yhirhsal","comment":[{"@type":"Comment","text":"What?!? You just don’t go hacking your competition for fun! 😤\nWhen they have no IDEA you’re coming?\nBro, that’s a crime here in America 🚫\nAlso where can I get access to this cool Opus 5 version? asking for a friend","datePublished":"2026-09-18T13:33:08.710Z","url":"https://daily.dev/posts/8yHiRHsAL#c-K9vMMl4zH","author":{"@type":"Person","name":"Peter Cruckshank","url":"https://daily.dev/petecapecod","image":"https://media.daily.dev/image/upload/s--ZJhQyKws--/f_auto/v1721235024/avatars/avatar_A9xh33q0QoxtkGoJRCosp"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2}},{"@type":"Comment","text":"The same Opus 5 that’s doing sh*t on my codebase?","datePublished":"2026-09-18T08:53:31.818Z","url":"https://daily.dev/posts/8yHiRHsAL#c-vK0zklMc6","author":{"@type":"Person","name":"Oyeniyi Isaac","url":"https://daily.dev/isaac0yen","image":"https://media.daily.dev/image/upload/s--xi7tWp_S--/f_auto/v1718722675/avatars/avatar_3sVwNtK2xXTBsCb7yiWw6"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2}},{"@type":"Comment","text":"The war of the AIs 😀","datePublished":"2026-09-18T13:06:42.842Z","url":"https://daily.dev/posts/8yHiRHsAL#c-GKGlIgiXT","author":{"@type":"Person","name":"Doncho Angelov","url":"https://daily.dev/doncho","image":"https://media.daily.dev/image/upload/s--j1MSm0hy--/f_auto/v1716369534/avatars/avatar_EB0j0Umzh5v3zGWUSL5ma"}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/three-researchers-hacked-openai-using-claude-opus-5-to-do-it-8yhirhsal#faq","mainEntity":[{"@type":"Question","name":"How did researchers manage to hack OpenAI in July using Discourse?","acceptedAnswer":{"@type":"Answer","text":"A flaw in Discourse, the forum software OpenAI uses, allowed researchers to steal authentication tokens belonging to OpenAI employees. Some tokens worked directly on ChatGPT, while others granted access to OpenAI's GitHub service through SSO token reuse, letting one compromised identity pivot across multiple internal systems. Security teams tracking SSO and identity-boundary risks follow incidents like this on daily.dev."}},{"@type":"Question","name":"What data was exposed when OpenAI employee accounts were compromised?","acceptedAnswer":{"@type":"Answer","text":"OpenAI's internal review found only limited reads of private-repository metadata and code changes, with no model weights exposed. However, the researchers confirmed they took over ChatGPT and Codex accounts belonging to OpenAI employees and some regular users, meaning attackers reached private code repositories even if the damage was contained. Anyone assessing the real blast radius of a breach can follow how incidents like this get scoped on daily.dev."}}]} ```