← Back to feed
2026-09-20 Prompt InjectionMalicious Tool TLP:CLEAR

Researchers Use Claude Opus 5 to Exploit OpenAI ChatGPT and Gain Access to Internal GitHub

Date: 2026-09-20
Tags: prompt-injection, malicious-tool

Executive Summary

Security researchers from Hacktron AI used Anthropic's newly released Claude Opus 5 to help turn an image-processing vulnerability into an exploit chain that compromised an OpenAI employee's ChatGPT account and reached the company's internal GitHub environment. The entire timeline from initial discovery to access to OpenAI repo access took place in less than 72 hours. The researchers said the Claude model they were using couldn't build a working exploit at first, but that changed overnight when Anthropic released Opus 5.

Campaign Summary

FieldDetail
Campaign / MalwareHacktron OpenAI Bug Bounty Exploit Chain
AttributionHacktron AI (security researchers) (confidence: high)
TargetOpenAI employee accounts and internal GitHub infrastructure
VectorClaude Opus 5 LLM-assisted exploit development targeting Discourse image-processing vulnerability and account takeover flaw
Statusdisrupted
First Observed2026-07-27

Detailed Findings

Opus 4.8 struggled across several sessions to produce a working exploit. Within hours of Opus 5's release, the researchers gave it the same problem and it succeeded. Once inside OpenAI's Discourse forum at community.openai.com, the researchers found another flaw that let them take over users' ChatGPT and Codex accounts, including those belonging to OpenAI employees. That host is OpenAI's own community forum. It is the affected product, not an IOC. They took over an OpenAI employee's account whose Codex was connected to OpenAI's Github organization, then sent a prompt to this employee's Codex account to open a PR for them in OpenAI's internal monorepo. OpenAI fixed the flaw within about 14 hours of the report's submission and paid the Hacktron team a 6,500 dollar bounty. The incident demonstrates how advances in LLM reasoning capability reduce the technical skill barrier for chaining vulnerabilities into end to end exploits targeting AI vendor infrastructure.

MITRE ATT&CK Mapping

TechniqueIDContext
Exploit Public-Facing ApplicationT1190Claude Opus 5 used to identify and exploit image-processing vulnerability in Discourse forum software

IOCs

Domains

No domain IOCs published by source

Full URL Paths

No URL IOCs published by source

Splunk Format

No IOCs available for Splunk query

File Hashes

No hash IOCs published by source

Detection Recommendations

Monitor for LLM-assisted exploit chains targeting your infrastructure. Implement continuous vulnerability disclosure monitoring on Discourse versions; ensure image processing functionality has robust input validation. Track access logs for lateral movement from forum accounts to code repositories. Establish incident response procedures that assume LLM tools may be used to accelerate vulnerability research and exploitation. Implement strict access controls for code hosting platforms with zero-standing access and time limited elevated permissions.

References