Breaking

Researchers Used Claude Opus 5 to Chain Image-Upload and SSO Flaws Into OpenAI Account Access

September 18, 2026 at 05:11 EDT

Security
AI Agents
Software Dev & Coding

A Hacktron AI research team says it used Anthropic's Claude Opus 5 to turn a HEIF image-processing flaw and an OpenAI single sign-on weakness into access to OpenAI employee ChatGPT and Codex accounts, then proved reach into an internal GitHub environment with a harmless pull request. OpenAI fixed the identity issue after responsible disclosure, while Discourse separately patched the underlying image-upload remote-code-execution vulnerability.

September 2026 · OpenAI

Image upload to agent access

Researchers chained a HEIF decoding flaw with an identity weakness, then used a connected coding agent to demonstrate reach into an internal repository workflow.

The verified time scale

local ARM64 exploit

14h

fix confirmation

<72h

full reported chain

Each block represents roughly six hours; smaller values are rounded up for visibility.

8.8

CVSS severity for the image-upload RCE

$6,500

bounty for the OpenAI-side finding

#1186742

harmless internal pull request used as proof

How the chain moved

1. Image upload

HEIF decoding exposed a vulnerable parser.

→

2. Code execution

The processing environment became the foothold.

→

3. Identity jump

A sign-on weakness expanded access to AI accounts.

→

4. Agent connector

A coding agent connection proved repository reach.

Why defenders noticed

The proof stopped at a harmless pull request and was reported through a bounty process.

Why the risk is larger

AI workspaces connected to code, mail, docs and chat can inherit broad account permissions.

Continue reading

The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.