Claude Opus 5 Wrote the Exploit That Broke Into OpenAI

A three-person team at the San Francisco security startup Hacktron spent 72 hours in late July chaining two flaws until they were inside OpenAI’s GitHub organisation, and published the write-up this week. The detail that will travel is not the target. It is that the same exploit was attempted twice with two different models, and only the newer one could write it.

The way in was not OpenAI’s infrastructure but its community forum, which runs on Discourse. Discourse’s upload pipeline uses FastImage to sanity-check images, and FastImage does not understand the HEIC/HEIF format iPhones produce — so those files fell through to ImageMagick, which decodes them with libheif. The Debian 12 base image in Discourse’s Docker container shipped libheif 1.19.7, a build that, in Hacktron’s words, was missing some upstream security fixes that “were not back-ported to the libheif package.” An attacker-supplied photo was therefore an attacker-supplied heap buffer overflow.

Turning that overflow into reliable code execution is the hard part, and this is where the timeline gets pointed. Hacktron started on the image pipeline on 23 July. On 24 July they worked the bug with Claude Opus 4.8 — available to them through the access programme Anthropic runs for security researchers — and it repeatedly failed to produce an exploit that survived ASLR. Opus 5 shipped that evening. A fresh session with the same problem returned a working ARM64 exploit within three hours; the team ported it to x86-64 with a jemalloc configuration and confirmed local remote code execution through an image upload at 6am on 25 July. Four hours later an autonomous Claude agent reproduced the RCE against Discourse Cloud.

The second flaw is the one that made it OpenAI’s problem rather than Discourse’s. The forum authenticated through “Sign in with OpenAI” against auth.openai.com, and once the researchers held administrative access to the Discourse instance, a misconfiguration in that single sign-on flow let them take over employee ChatGPT and Codex accounts without any further authentication. One of those Codex accounts was connected to OpenAI’s GitHub organisation. To demonstrate the reach without touching anything sensitive, they opened pull request #1186742 in the internal openai/openai monorepo between 13:30 and 15:30 UTC, and then stopped testing.

Disclosure was fast on both sides. Hacktron filed through OpenAI’s Bugcrowd programme the same day; OpenAI confirmed its half was fixed at 22:49 UTC, fourteen hours after submission, and Discourse shipped its fix on 27 July. The bounty was $6,500, with OpenAI noting that the award covered the OpenAI-side finding rather than the work against Discourse, since the forum sat outside the scope of its programme. That scoping line is doing a lot of work: the forum was not OpenAI’s to test, and it was also the door.

Hacktron frames the OpenAI chain as one output of a wider libheif campaign it calls the HEIF Heist, which it says reached Slack, Meta, Zoom, Shopify and GitHub Enterprise among others. The economics it reports for that campaign are the uncomfortable part: two months, three researchers, and under $3,000 in model tokens. The OpenAI portion, by their account, took a few days of agent time and a few hours of human time. Work that would once have needed a well-resourced team and months of effort is being compressed into days, and the write-up argues plainly that “security assumptions must catch up with attacker capabilities.”

Two caveats are worth keeping attached to this. The researchers were white hats who reported and stopped, and the capability they used is the same one defenders are being handed — Anthropic and OpenAI both gate these models behind vetted-access programmes precisely so that this work happens in public write-ups rather than quietly. And the underlying bugs were ordinary: an unpatched library in a base image, and an SSO flow that trusted a forum more than it should have. No model invented either of them.

What the episode does supply is a clean, dated measurement of something the labs usually describe in the abstract. The same team, the same target, the same bug, one model generation apart: Opus 4.8 could not get past ASLR across several sessions, and Opus 5 cleared it in three hours. That is a sharper read on exploit-development capability than most published evaluations manage, and it arrived not from a red-team report but from a bug bounty filed the morning after a launch. The labs publish their cyber capability thresholds on their own schedule; the field is now generating its own datapoints, and it does not wait for the system card.