Three researchers at Hacktron sat down with Anthropic’s Claude Opus 5 and a browser pointed at OpenAI’s public help forum. A bug in the forum software, then a weakness in OpenAI’s own login system, and they held ChatGPT and Codex sessions for several employees. From there they reached an internal code repository. This was disclosed research, and it still maps the hole most cybersecurity programs leave open: customer-support software treated as a content site, sitting one hop from staff identity.

You already watch the IdP for brute-force noise. This chain looked like a customer asking for help, which is why those dashboards stayed quiet. Claude Opus 5 compressed the time it took to stitch the forum defect to the login defect. Your patch SLAs and weekly vuln meetings still assume a human has to notice that those two systems share a trust domain.

The Ticket Queue Sat Next to Staff SSO

OpenAI runs a public help forum because customers need a place to talk. That software is a production host sitting on the identity plane. It issues sessions, handles mail, resets state, and talks to the login fabric employees use for ChatGPT and Codex. Once Hacktron’s researchers crossed that fabric, staff accounts were the prize. An internal code repository was in reach. You should assume the same shape in your stack. Community sites, ticket portals, status pages that share a cookie parent, the “contact support” widget that calls an internal API. Those boxes sit outside the mental model of cyber security even when they sit inside the same SSO.

This is a bad look for any shop that files forum CVEs as low-severity public content. The researchers needed a logic bug plus a login weakness, the daily diet of internet apps you expose on purpose. If your threat detection only lights up on endpoint beacons, a help-desk chain dies in the noise of legitimate tickets.

Ask who can turn a forum session into a staff session. Shared cookie domains. OAuth clients the community app is allowed to request. Magic links that land on the corporate IdP. Support-agent impersonation features. Login-as-user buttons that still have an API. Those are the seams. Write them down before a model that does not get tired maps them for someone else.

Access Rights Manager Shipped the Master Key

While that research made the rounds, SolarWinds patched Access Rights Manager. CVE-2026-28326 carries an 8.8 CVSS score and hits every ARM 2026.2 release and prior. The defect is a hard-coded key that can yield unauthenticated remote code execution if you can reach the service. ARM is the product you buy to see who has rights. It arrived with a secret that made reachability the authenticator.

Same failure class as the help forum. A system whose job is access control skipped authentication and handed you execution. Defense in depth collapses when the identity box is the first unauthenticated RCE you meet past the perimeter. If the management plane answers without a real credential, the story your firewall tells about “internal only” is the entire control. Flat networks, contractor VPNs, one exposed port, and the rights tool is a root shell.

Hard-coded keys keep shipping because compiled secrets are convenient and appliance updates feel optional. If ARM is on your network, patch it, pull it off the internet, and rotate every token it ever minted. Then hunt the next compiled HMAC in the rest of the identity catalog. That hunt is threat-protection you already owe the auditors.

The Forum Needs Staff-Grade cybersecurity Controls

Start with inventory you can finish before lunch. List every public community, knowledge base, ticket portal, and chatbot that can send mail or set a cookie on a corporate domain. For each one, write down the identity it shares: SSO client, cookie parent, magic-link issuer, support impersonation API. If that list is empty, you have not looked. Put those hosts on the same exposure register as VPN concentrators. Internet-facing help software is a login path.

Immediate cuts are boring and they work. Split cookie domains so the forum cannot present a staff session. Kill login-as-user from untrusted networks. Require phishing-resistant MFA on the IdP even when the request arrives from a support tool. Move admin APIs off the public listener. Your firewall should not forward management paths to the same VIP that serves the community. Rotate secrets that shipped in binaries, configs, and sample HMAC keys. That is security hardening you can evidence this week, vendor-neutral, no new platform required.

Change what you call a signal on an ongoing basis. Alert when a staff account for ChatGPT, Git, or a cloud console appears after a forum session from the same IP or device. Alert on new OAuth grants minted by community apps. Treat a compromise of help-desk software as patient zero for account takeover. Run incident response that revokes employee SaaS sessions, support impersonation tokens, and repo credentials in one motion. Hash-only threat-protection misses this. You want session-level threat detection on the identity plane.

Keep a quarterly drill. Pick the forum host, assume unauthenticated read, and ask how far a researcher gets toward staff SSO and source. Patch SLAs for community software should match identity software, because that is what it is. Models will keep shortening the chain. Your job is shrinking the trust domain they chain through.

Sources

• Claude Opus 5 Helped Researchers Take Over OpenAI Staff Accounts via Chained Flaws
• SolarWinds Patches ARM Hard-Coded Key Flaw Enabling Unauthenticated RCE