Executive Summary
In late July, security researchers at startup Hacktron AI used Anthropic’s Claude model to breach OpenAI’s internal systems via a two-stage vulnerability chain. The attack was conducted under OpenAI’s official bug-bounty program, and the team reported its findings immediately, receiving a $6,500 reward.
Key facts:
- Attack time: late July
- Reported immediately after discovery
- OpenAI/Discourse patch issued: days later
- Bounty amount: $6,500
- Claude version used: Opus 5
- Vulnerability type: Two chained critical flaws (Discourse image handling + ChatGPT account takeover)
Notably, the Claude version deployed did not face security export restrictions, unlike the later Mythos 5 release, which was temporarily locked down over concerns about advanced hacking capabilities.
Technical Breakdown of the Attack Chain
The initial entry point was a HEIF/HEIC image upload flaw in OpenAI’s Discourse-powered community forum. When users uploaded iPhone-native HEIF images, Discourse processed them through ImageMagick, which in turn invoked libheif for decoding—a library dating back decades and widely used for image manipulation.
The root cause: libheif contained a memory-safety bug. A specially crafted image caused the library to miscalculate image positioning during conversion, enabling remote code execution.
Critically, this vulnerability had been patched months earlier by libheif maintainers, but the patch was never formally designated as a security issue (i.e., no CVE was assigned). Hacktron suspects this explains why Discourse instances remained on the vulnerable build.
After compromising the Discourse server, researchers discovered a second, more severe flaw enabling full account takeover of ChatGPT and Codex accounts—including those of OpenAI employees. One compromised employee’s Codex was tied to OpenAI’s GitHub organization, granting access to internal code repositories.
Critical Model Comparison: Opus 4.8 vs. Opus 5
Hacktron explicitly documented how model iteration determined success or failure:
| Model Version | Attack Success | Development Time |
|---|---|---|
| Opus 4.8 | Failed | Multiple sessions, no working exploit generated |
| Opus 5 | Success | Within hours of release, working exploit produced immediately |
The overnight leap in capability demonstrates how rapidly frontier models are enhancing exploit automation—turning months-long reverse-engineering tasks into hours of AI-assisted work.
Broader Implications
This incident reveals systemic challenges:
- Supply chain opacity: Production-critical open-source tools often rely on dependencies with unsung fixes. Missing CVEs mean many enterprises cannot easily detect risk.
- Democratized hacking: Gray Swan’s Matt Fredrikson noted that “for $200 a month, anyone can use these tools and hack into a company like OpenAI.”
- Capabilities race: While Opus 5 remains unrestricted, Mythos 5 faced controls. Meanwhile, open-weight models like Z.ai’s GLM-5.2 are closing the gap on frontier models in cybersecurity tasks.
Practical Recommendations
- Security teams should audit third-party components for non-CVE updates, especially image parsers and decoders common in forum or social platforms.
- Adopt AI-augmented fuzzing: Integrate models like Claude into continuous penetration testing—not as replacement, but as scalable exploration tools.
- Individual researchers need not panic yet: exploits like this require access to specialized models and infrastructure. However, the incident warrants heightened vigilance toward open-source dependency hygiene.
Final Thoughts
One AI-accelerated, chained exploit has refocused attention on a quiet sector: the silent updates in foundational libraries. As debates rage over frontier model limits, the balance of offensive and defensive capabilities may be shifting not in labs, but in repositories where security patches go unmarked and untracked.