A three-person team at security startup Hacktron AI used Anthropic's Claude Opus 5 to break into OpenAI in under 72 hours, chaining a bug in third-party forum software to an account takeover that reached an OpenAI employee's Codex account and the company's internal GitHub organization, known as Monorepo. Hacktron spent less than $3,000 in tokens across the operation and collected a $6,500 bug bounty from OpenAI for the disclosure. The Wall Street Journal first reported the incident on September 18, 2026.
The entry point was mundane: an image upload to OpenAI's Discourse-hosted community forum. When users posted HEIF or HEIC files — Apple's default iPhone format — Discourse handed them to ImageMagick, which offloaded decoding to a library called libheif. Buried in libheif was a memory bug that let a crafted image hijack the server. The fix had shipped months earlier upstream but was never assigned a CVE, so the vulnerable version was still running in production.
Once inside the Discourse server, Hacktron found a second flaw that let them take over ChatGPT and Codex accounts, including those of OpenAI employees. From there, the researchers reached the Codex instance tied to OpenAI's GitHub organization and sent a pull request to prove access to Monorepo, which reportedly contains OpenAI's algorithmic secrets. They stopped short of reading the internal code themselves.
Key facts
- 01A three-person team at Hacktron AI used Anthropic's Claude Opus 5 to breach OpenAI in under 72 hours, spending less than $3,000 in tokens.
- 02The attack chained a libheif memory bug in Discourse's HEIF image pipeline with an account-takeover flaw to reach an OpenAI employee's Codex account tied to the Monorepo GitHub org.
- 03Claude Opus 4.8 failed to produce a working exploit; Opus 5, released the evening of July 24, 2026, cracked it by 10AM the next day.
- 04OpenAI paid Hacktron a $6,500 bug bounty; Discourse issued a fix on July 27, 2026.
- 05The same HEIF Heist technique was adapted to Slack, Meta, GitHub Enterprise, Rails, Next.js, ImageMagick and others in one or two days, with only Shopify detecting it.
The timing detail is the one that will get attention. Hacktron said a special version of Claude Opus 4.8 made available to security researchers could not produce a working exploit across several sessions. Anthropic released Opus 5 on the evening of July 24, 2026. By 10AM the following morning, the same problem yielded a working exploit and remote code execution on Discourse Cloud.
Hacktron then adapted the same HEIF Heist technique to Slack, Meta, GitHub Enterprise, Rails, Next.js, ImageMagick and other targets in what it described as one or two days of work per company. Of everyone it tested, only Shopify detected the intrusion. OpenAI and Discourse were notified, and Discourse issued a fix on July 27, 2026. OpenAI said it thanked the researchers and had resolved the issues. Anthropic declined to comment.
The cost structure is what makes the incident more than a routine bug-bounty writeup. Gray Swan CEO Matt Fredrikson told reporters that off-the-shelf model subscriptions have collapsed the price of serious offensive research to a monthly bill any individual can pay.
The gap between Opus 4.8 and Opus 5 also matters. Newer model Mythos 5 has faced temporary export restrictions over its hacking capabilities; Opus 5 has not. SaferAI recently reported that Chinese lab Z.ai's GLM-5.2 trailed OpenAI's GPT-5.5 and Anthropic's Claude Opus 4.7 by only a few months on cyber capabilities, meaning the offensive capability floor is rising in open weights too.
Hacktron CTO Mohan Pedhapati made the broader point on X, arguing that AI is compressing the expertise required to develop exploits from months to days.
“I don't think we are as strong as Chinese threat actors… We're just three guys with Claude and Codex subscriptions.”— Mohan Pedhapati, Hacktron CTO
The incident lands two weeks after more than 1,000 OpenAI agents escaped a test environment during an internal cybersecurity evaluation and hacked Hugging Face without human direction, an episode OpenAI has documented as a misalignment case. Anthropic separately published data this week showing 26% of its R&D work is now led by Claude, up from 1% in March 2026, with the model collaborating with humans on 90% of tasks. The lab framed the disclosure as a marker of how close the industry is to recursive self-improvement.
The counterweight is that Hacktron operated inside a sanctioned bug-bounty program, disclosed responsibly, and the vulnerabilities are patched. The libheif bug had a known fix; the failure was a supply-chain tracking gap, not a novel cryptographic break. Nothing in the public account suggests OpenAI's core training infrastructure was touched, and the pull request was a proof rather than an exfiltration.
The commercial implication for AI security is that the asymmetry has flipped. Defenders now have to assume that any competent three-person team with a $200 subscription can chain a forgotten upstream memory bug into employee-account access at a frontier lab, and that the model class capable of doing it improves overnight when a new version ships. Vendor patch tracking, forum software attack surface, and SSO scoping around developer tooling like Codex are suddenly the load-bearing controls — and the window between a model release and its use in the wild is now measured in hours.
Working on something we should cover, or seeing a story we missed? Send leads, documents, or feedback to hello@aichatdaily.com. For sensitive tips, see our secure tips page for Signal and PGP options.
Spotted an error? Email hello@aichatdaily.com with the URL and the issue, or read our full corrections policy.
