Hacktron AI researchers use Claude Opus 5 to test the OpenAI system in 72 hours

Researchers from the cybersecurity startup Hacktron AI, leveraging Anthropic’s newly released Claude Opus 5 model, completed a full attack chain test against OpenAI’s systems within 72 hours. The research team first achieved remote code execution by exploiting a heap buffer overflow vulnerability in libheif used for image processing on OpenAI’s Discourse community forum. They then identified a flaw in OpenAI’s single sign-on authentication, escalating privileges from the server to employee ChatGPT and Codex accounts, and ultimately gaining access to OpenAI’s internal GitHub environment. The vulnerabilities involved carried a CVSS score of 8.8; OpenAI patched them on July 28 and awarded the research team a $6,500 bounty. This case demonstrates that AI agents are significantly reducing the time required for advanced exploitation, while AI accounts—connected to diverse services like GitHub and Slack—are emerging as new privilege hubs.

Article author and source: Wall Street Journal

A highly ironic security incident is drawing attention: researchers used Anthropic’s latest Claude Opus 5 to progressively turn an image processing vulnerability into a full attack chain, ultimately gaining access to a ChatGPT account belonging to an OpenAI employee and further infiltrating OpenAI’s internal GitHub environment. This signifies that AI is rapidly intensifying the cybersecurity arms race, drastically lowering the barrier and cost of advanced exploit development.

Researchers from the cybersecurity startup Hacktron AI disclosed the above actions this week. According to recent reports by The Wall Street Journal, the team gained access to a ChatGPT account belonging to an OpenAI employee and had the ability to read and submit private software changes at OpenAI. Hacktron stated that the researchers disclosed the issue on July 25 through OpenAI’s Bugcrowd vulnerability bounty program; OpenAI confirmed on the same day that it had patched the vulnerability on its end and paid the research team a $6,500 bounty.

The key issue in this incident is not just that a single vulnerability was exploited, but that multiple security boundaries were chained together: a vulnerability in third-party infrastructure, flaws in federated identity authentication, and AI agent accounts deeply integrated with internal enterprise systems. For companies heavily deploying AI agents, this attack path means that previously isolated security risks could be linked by AI accounts into a complete chain of permissions.

Full attack chain: From image upload to internal codebase

The initial entry point of this attack was the OpenAI community forum, community.openai.com, which runs on the Discourse platform.

Hacktron discovered that HEIC and HEIF images uploaded to Discourse are processed by ImageMagick and decoded by libheif. Researchers noted that the version of libheif in the affected environment contains a heap buffer overflow vulnerability that can be exploited for remote code execution (RCE). Discourse subsequently confirmed the vulnerability, issued a security advisory on July 28 with a CVSS score of 8.8, and deployed a patch while strengthening the image processing sandbox.

But breaching the forum server was only the first step. Hacktron then discovered another vulnerability in OpenAI’s single sign-on (SSO) implementation, allowing researchers to further escalate control of the forum environment into access to ChatGPT and Codex accounts, including OpenAI employee accounts. The researchers emphasized that this privilege escalation was not a Discourse vulnerability, but rather an independent issue at OpenAI’s authentication layer.

After accessing the employee's Codex account, researchers discovered that the account was connected to OpenAI's GitHub organization. They instructed Codex to create a harmless pull request within OpenAI's internal monorepo (openai/openai) to demonstrate that the account compromise could extend further into developer infrastructure, while avoiding access to sensitive source code.

Claude Opus 5 compresses exploit timelines to within 72 hours.

Another noteworthy aspect of this incident is that the AI model directly participated in the development of the exploit.

Hacktron stated that researchers initially used Claude Opus 4.8 to analyze the vulnerable libheif and attempted to develop an exploit, but struggled to reliably reproduce the issue with Address Space Layout Randomization (ASLR) enabled. Anthropic released Claude Opus 5 on July 24, positioning it as a significant upgrade for long-running agents and programming tasks.

After switching to Opus 5, the model generated a usable ARM64 exploit within hours, then adapted it to the x86-64 and jemalloc environments used by Discourse. Hacktron stated that the entire process, from vulnerability discovery to gaining access to OpenAI’s codebase, took less than 72 hours.

This case demonstrates that AI agents are reducing the time and cost required for advanced exploitation. In the past, exploiting memory corruption vulnerabilities typically required extensive reverse engineering, debugging, and development work to create stable exploits; however, cutting-edge programming models are now capable of handling a significant portion of this work under human guidance.

AI agent accounts have become the new authority hub.

The deeper impact of this incident on the company’s security architecture may stem from the location of the AI agent accounts.

Hacktron noted that compromised ChatGPT or Codex accounts may be connected to multiple services such as GitHub, Slack, Outlook, Gmail, and Google Drive. Once an AI account is breached, attackers could potentially inherit downstream system permissions associated with it, transforming the AI account from a single-application credential into a central hub for identity and authorization linking code, communication, and enterprise data.

Hacktron also categorized this OpenAI incident as part of a broader "HEIF Heist" investigation, noting that the same methodology extends to platforms such as Slack, Meta, Zoom, Shopify, and GitHub Enterprise. However, publicly disclosed technical details and vendor confirmations are currently focused primarily on the OpenAI case.

For enterprise security teams, this incident highlights several key protection priorities: isolating untrusted file processing pipelines, promptly patching vulnerabilities in underlying dependencies, narrowing the trust scope for federated identity authentication, and managing AI agent credentials and permissions with standards approaching those for privileged accounts. As AI agents gain further access to internal enterprise systems, a compromised AI account could allow downstream propagation of damage along its chain of connected permissions.