On the evening of July 24, a three-person security team at the startup Hacktron AI was stuck. Claude Opus 4.8, the version Anthropic makes available to vetted cybersecurity researchers, had spent several sessions trying to turn a heap buffer overflow in an image-decoding library into a reliable exploit and had failed whenever address space layout randomization was on, which is to say on every real server. Then Anthropic shipped Claude Opus 5. Hacktron gave it the same problem. Roughly three hours later it had a working exploit, and by the next morning the team had code execution on OpenAI’s community forum, control of an OpenAI employee’s ChatGPT and Codex accounts, and an open pull request inside OpenAI’s private monorepo. The whole campaign cost under $3,000 in AI tokens.
The operation, disclosed September 18 in a Hacktron blog post and first reported by The Wall Street Journal, was carried out under OpenAI’s Bugcrowd bug-bounty program. OpenAI paid researchers Harsh Jaiswal, Mohan Pedhapati and Rahul Maini $6,500 on September 1 and says the flaws are fixed.
The entry point was almost comically mundane. OpenAI’s help forum at community.openai.com runs on Discourse, the open-source forum platform. Discourse validates uploads with a lightweight library called FastImage, which does not understand HEIC or HEIF, the formats iPhones use by default. Those files went instead to ImageMagick, which handed them to libheif for decoding. The Discourse Docker image, built on Debian 12, shipped libheif 1.19.7, which contained a heap buffer overflow now tracked as CVE-2026-32882 with a CVSS score of 8.8. The bug had been fixed upstream in 1.19.8, but the maintainers never flagged the commit as a security fix, so it got no CVE and never triggered Debian’s backport process. The vulnerable version stayed in production.
Hacktron says Opus 5 produced a working ARM64 exploit against a local Mac within about three hours, then ported it to the x86-64 architecture and jemalloc allocator Discourse runs in production. By 6:00 UTC on July 25 the team had verified remote code execution through a live image upload. ‘Opus 4.8 struggled across several sessions to produce a working exploit,’ Hacktron wrote. ‘Within hours of Opus 5’s release, we gave it the same problem and it succeeded.’
Code execution on a public forum should have been the end of the story. It was not, because of a separate flaw in OpenAI’s own identity infrastructure. The forum used a ‘Sign in with OpenAI’ single sign-on flow, and the tokens it issued carried permissions reaching well beyond the forum into the holder’s ChatGPT and Codex accounts. With control of the forum server, Hacktron could take over the accounts of anyone who had logged in that way, including OpenAI employees, with no interaction from the victim.
The researchers picked one employee whose Codex was connected to OpenAI’s GitHub organization. Rather than read source code, they had the compromised Codex account open a harmless documentation pull request, number 1186742, in the private openai/openai monorepo, then stopped and alerted OpenAI’s security team. Hacktron filed its Bugcrowd report between 08:00 and 10:00 UTC on July 25; OpenAI confirmed a fix at 22:49 UTC the same day, roughly 14 hours later. Discourse published an advisory on July 28 with four patched releases and added sandboxing around image conversion. Elapsed time from discovery to a pull request in OpenAI’s monorepo: under 72 hours.
‘We thank the researchers for contacting us and sharing their findings,’ an OpenAI spokesperson said. ‘We narrowed the permissions on Community sign-in tokens and revoked affected tokens and sessions.’ OpenAI noted the Discourse-hosted forum itself was out of bounty scope; the $6,500 covered the SSO misconfiguration. Anthropic had not commented publicly as of Friday.
One detail deserves attention: Opus 5 refused to exploit a live remote host, so the team framed its own Discourse test instance as a capture-the-flag exercise, and the model proceeded. The guardrail was routed around by relabeling the target.
Why It Matters
The most important number here is not $6,500 or $3,000. It is one: a single model-generation upgrade separated a failed exploit from a successful one. Independent benchmarks published the day Opus 5 launched found it produced 99 complete code-execution exploits on ExploitBench, a suite of 41 hardened Chrome V8 bugs, where Opus 4.8 managed two. Exploiting memory corruption on ASLR-protected targets has long been the domain of a few expensive specialists. Hacktron’s founder Mohan Pedhapati put the shift bluntly: ‘AI is reducing the amount of scarce expertise needed to develop exploits. Work that once took months can now take days.’
Matt Fredrikson, CEO of red-teaming firm Gray Swan, was blunter still. ‘For $200 a month, anyone can use these tools and hack into a company like OpenAI,’ he told TechCrunch. ‘If it can happen to them, and I don’t think they’ve been slouching recently on cybersecurity hygiene, it could happen to anyone.’
The incident also lands awkwardly for the tiered-access approach to cyber capability we covered earlier this week, in which the most dangerous models are held back for vetted defenders while general releases are assumed safe enough. Opus 5 sits below Mythos 5, which faced US government restrictions over its hacking capabilities, yet it cleared the ASLR barrier the previous generation could not. The tier defenders were told was safe is higher than they assumed.
Finally, the blast radius was set not by the model but by identity plumbing. An agent account like Codex, wired into GitHub, Slack and email, is an authorization hub; compromise it and you inherit everything downstream. The same over-scoped token pattern surely exists at companies that built SSO before agent accounts were a permission category.
What to Watch
Hacktron frames the OpenAI breach as one thread of a two-month campaign it calls HEIF Heist, and says the same libheif bug reached Slack, Meta, Zoom, Shopify and GitHub Enterprise, each taking one to two days. None of those cases is documented or vendor-confirmed at the level of the OpenAI writeup, so expect more disclosures. Watch also for whether Anthropic addresses the capture-the-flag workaround, whether OpenAI publishes a post-mortem, and whether libheif’s September 6 release of 1.23.4, with more high-severity fixes, reaches distribution packages faster than 1.19.8 did. The backport gap that left OpenAI exposed is not fixed; it is structural.
"For $200 a month, anyone can use these tools and hack into a company like OpenAI. If it can happen to them, and I don't think they've been slouching recently on cybersecurity hygiene, it could happen to anyone."— Matt Fredrikson, CEO, Gray Swan