Claude Opus 5 Helped Researchers Take Over OpenAI Staff Accounts via Chained Flaws.

If you use a public forum with single sign-on to internal tools, your staff accounts are at risk. Ensure your SSO only grants access after re-authentication for sensitive actions.

Three security researchers at Hacktron successfully leveraged Anthropic's Claude Opus 5 to chain two vulnerabilities, gaining access to OpenAI employee accounts and an internal code repository. The exploit chain began with a flaw in the software powering OpenAI's public help forum, which led to a weakness in OpenAI's single sign-on (SSO) system. This allowed the researchers to take over the ChatGPT and Codex accounts of OpenAI staff members who had logged into the forum. The team reported the vulnerabilities to OpenAI, demonstrating access with a non-malicious pull request to an internal repository. OpenAI confirmed the fix within 14 hours and awarded the researchers a $6,500 bounty. While the researchers did not access sensitive data, they noted the potential for broader access to services like GitHub, Slack, and email due to the compromised SSO.

This incident highlights a critical security oversight: the reuse of an SSO mechanism across a public-facing, lower-trust forum and internal OpenAI services. The researchers effectively demonstrated that a vulnerability in a seemingly innocuous platform can cascade into significant internal access if authentication systems are not robustly segmented. The exploit's reliance on a patched but still deployed library (libheif 1.19.7 on Debian 12) also underscores the supply chain risk inherent in software dependencies, where even known fixes may not reach all systems promptly. This suggests a broader industry challenge in maintaining consistent security patching across diverse environments.

The successful exploitation, aided by Claude Opus 5, signifies the accelerating capability of AI models in offensive security research, drastically reducing the time and expertise required to chain complex vulnerabilities. This raises concerns for both defenders and attackers, as AI-assisted exploit development becomes more accessible. The incident also points to the growing importance of securing not just core applications but also the interconnected ecosystem of third-party tools and libraries they depend on. Organizations must prioritize stronger identity management, including multi-factor authentication and context-aware access controls, to mitigate risks from such chained attacks.