{"data":{"id":"1c08a1a1-8fc7-4edc-87c9-334ec8489e20","title":"Claude Opus 5 Helped Researchers Take Over OpenAI Staff Accounts via Chained Flaws","summary":"Three Hacktron researchers used Anthropic's Claude Opus 5 to chain a bug in Discourse, the open-source software behind OpenAI's public help forum, with a weakness in OpenAI's \"Sign in with OpenAI\" single sign-on, taking over ChatGPT and Codex accounts of several OpenAI employees and reaching an internal code repository. The team reported the flaws, proved access with a harmless pull request, and stopped; OpenAI confirmed a fix about 14 hours later and paid a $6,500 bounty on September 1.","solution":"Rebuild the self-hosted Discourse server on the latest image so it ships the patched libheif, since a web-interface update alone may not replace the old library. Fixed self-hosted releases are 2026.7.0, 2026.6.1, 2026.5.2, and 2026.1.6. Upstream libheif was fixed in 1.22.0 for CVE-2026-32882.","labels":["security","industry"],"sourceUrl":"https://thehackernews.com/2026/09/claude-opus-5-helped-researchers-take.html","publishedAt":"2026-09-19T10:01:10.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"medium","attackType":["other"],"issueType":"news","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":["OpenAI","Anthropic"],"affectedVendorsRaw":["Claude Opus 5","Claude Opus 4.8","ChatGPT","Codex","OpenAI SSO"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":"2026-09-19T10:01:10.000Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"advanced","impactType":["confidentiality","integrity"],"aiComponentTargeted":"api","llmSpecific":true,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null}}