Claude Opus 5 hacked OpenAI: Researchers entered its internal systems in 72 hours

Security researchers at startup Hacktron AI have managed to breach OpenAI ’s infrastructure using Anthropic’s Claude Opus 5 as a tool, in a scenario that clearly illustrates how modern AI models tip the balance of power between offense and defense. The team of three researchers chained together two critical vulnerabilities, gained access to OpenAI employee accounts on ChatGPT and Codex, and reached the company’s internal code repository — all in less than 72 hours.

The report was made under OpenAI’s bug-bounty program via Bugcrowd — more details of the case have been published on TechCrunch. OpenAI acknowledged the findings and paid a $6,500, fixing the vulnerability in about 14 hours. The interest in the case isn’t just technical: it’s how the newest generation of AI models — specifically Opus 5 — made a difference where an earlier version failed.

See also our coverage of Anthropic's recent Claude abuse report, which documented industrial-scale campaigns of model abuse.

How Claude Opus 5 "opened" OpenAI in 72 hours

On July 25, 2026 , Hacktron AI researchers focused their research on OpenAI ’s community forum , which runs on the Discourse platform. Their target was not OpenAI itself but third-party software — a common route for supply chain attacks. That same day, they began working with Claude Opus 4.8 , a special version for cybersecurity researchers provided by Anthropic . The model failed to produce a working exploit across multiple sessions.

That evening, Anthropic released Claude Opus 5. The researchers gave the new model the exact same problem. Within hours, Claude Opus 5 produced the first functional exploit for the ARM64 architecture and then adapted it to Discourse's x86-64 jemalloc environment. OpenAI confirmed the fix within 14 hours of the report, while Discourse issued an official update on July 28 with a CVSS score of 8.8.

Timeline of the attack

The full timeline of the attack clearly shows the difference Claude Opus 5 makes in operational exploit development. The sequence of events is impressively condensed — from initial investigation to full repository access in less than 72 hours, with the fix at OpenAI completed in a fraction of the time traditionally required for such supply chain issues.

• July 25, morning: Hacktron detects entry route via Discourse image upload.
• July 25, day: Claude Opus 4.8 is tested in several sessions but fails with ASLR enabled.
• July 24-25, evening: Anthropic releases Claude Opus 5 — change of scenery.
• Within 3 hours: Claude Opus 5 produces a working ARM64 exploit.
• A few hours later: Adaptation to x86-64 and jemalloc for Discourse.
• July 25, evening: Report via Bugcrowd to OpenAI and Discourse.
• +14 hours: OpenAI correction on its side.
• July 27-28: Discourse releases an official update with CVSS 8.8.

The vulnerability chain: from HEIC image to RCE

The entry point was annoyingly commonplace: an image upload. When a user uploaded a HEIF or HEIC file to the forum — the format used by iPhones by default — Discourse would run it through a toolchain to convert it to JPEG. The first stop was ImageMagick, which doesn’t handle Apple’s format directly and defers the decoding to the libheif library . Therein lay the problem.

• Heap buffer overflow in libheif 1.19.7 on Debian 12, with out-of-bounds read/write primitives when decoding a malicious HEIC image.
• Missing CVE: the bug had been fixed upstream months earlier, but without an official CVE identifier — that's why Discourse was running a vulnerable version.
• Toolchain: Discourse → ImageMagick → libheif, with the malicious image causing incorrect memory pointer calculation and server hijacking.
• SSO misconfiguration: after acquiring an RCE on the Discourse server, researchers exploited a single sign-on misconfiguration to take over employee accounts.
• ChatGPT and Codex accounts: the compromised account had Codex connected to GitHub, giving access to OpenAI's internal monorepo.

Why Opus 5 succeeded where Opus 4.8 failed

The critical limitation for Claude Opus 4.8 was Address Space Layout Randomization (ASLR). The model could not produce a reliable exploit against an ASLR-enabled target, a classic obstacle to memory corruption attacks. Claude Opus 5, according to Hacktron, “succeeded” when given the exact same problem, working in an autonomous loop against a local Discourse installation. No special training on offensive tasks was required — the gains are a byproduct of general model improvements.

Anthropic itself has documented the difference in the Claude Opus 5: the model detects vulnerabilities at a rate close to Mythos 5, but lags behind in converting them into operational exploits — a deliberate choice, because Claude Opus 5 was not trained on offensive cyber tasks. In practice, however, external evaluations by the UK AI Security Institute showed that Claude Opus 5 solved enterprise-network scenarios in 8 out of 10 attempts, when it already had access to the network. This is a qualitative leap that makes the previous generation of models almost obsolete in this dimension.

In comparison, the numerical findings from Anthropic's internal measurements clearly delineate the new generation's progress in vulnerability discovery and exploitation:

• OSS-Fuzz success: Claude Opus 5 79.4% vs. Opus 4.8's 38.5% — almost double.
• ExploitBench hits: 99 completed exploits from the newest model — a level that was previously out of reach for Opus 4.8.
• Firefox 147 evaluation: 52.4% success with the new model, a notable improvement.
• ExploitGym rating: significant improvement over 4.8 in a 2-hour window, Mythos 5 is coming close.
• ARM64 exploit: produced in 3 hours — weeks of work for a human expert.

Who is affected and who is not?

The problem is not limited to OpenAI. libheif is a widely used library that exists on a variety of platforms, from Slack and Meta to GitHub Enterprise, Ruby on Rails and ScreenConnect. Any application that accepts user-uploaded HEIC, HEIF or AVIF files and processes them with ImageMagick, libvips or sharp is potentially exposed. Also see how we explain using ChatGPT without leaking personal data, as an example that using AI tools safely requires systemic attention.

• Discourse: released the advisory update GHSA-vhm9-85gw-x335, adding sandboxing to image processing.
• libheif: upgrade to 1.23.2 or later along with updated libde265.
• Debian: fixed libheif packages were distributed on August 8, 2026.
• Disable: untrusted HEIF and AVIF decoding where not needed, or isolate in hardened ephemeral sandbox.
• SSO configuration: check for tokens with excessively broad permissions and frequent renewal.

What it means for cybersecurity

The case demonstrates in a practical way a profound shift in the balance of power between attack and defense. The step that traditionally required weeks of work by a skilled professional — developing a working memory-corruption exploit — was done by an AI model in a matter of hours. Defense teams no longer have the luxury of relying on exploit difficulty as a defense mechanism. The SecNews technical team notes that addressing it requires a multi-layered approach: rapid patching, sandboxing untrusted content, and strict management of SSO tokens.

At the same time, the case highlights a gap in the CVE process. The bug had already been fixed upstream without being flagged as a vulnerability, so it didn’t reach scanners and package managers that monitor CVE feeds. This is a more general problem in the open-source supply chain, which is dramatically amplified when AI models can detect and exploit such silent fixes in hours.

Practical protection measures

For organizations that handle user-uploaded images, the SecNews technical team recommends specific actions immediately, without waiting for the next update cycle. See also our report on the new obligations of the EU Cyber ​​Resilience Act, which establishes continuous compliance for software supply chains.

1. Immediately upgrade libheif to 1.23.2+ and libde265 to the latest version.
2. Full patching of Discourse (advisory GHSA-vhm9-85gw-x335) and all applications that consume HEIC/HEIF/AVIF.
3. Sandboxing image processing pipelines with container isolation or seccomp filtering.
4. SSO audit: detect tokens with overly broad permissions on community platforms and third-party services.
5. Monitoring for communication of image processing libraries with external endpoints.

Frequently asked questions

Did Anthropic really breach OpenAI? No — Hacktron researchers used Claude as an exploit development tool. Claude itself did not carry out the attack autonomously. The action was a conscious effort within the framework of a legitimate bug-bounty program.

What is the main difference between Opus 4.8 and Opus 5 in this scenario? Opus 4.8 was unable to bypass ASLR across multiple sessions. Opus 5 produced a working exploit in a few hours with the same issue, showing that each new generation of models dramatically reduces the time to develop exploits.

What should my business do? Immediately upgrade libheif to 1.23.2+, patch Discourse if you use it, sandbox image processing, and check SSO configurations. See the full steps in the relevant section of the article.

Anthropic itself has publicly stated that the model’s capabilities are intended to empower defense teams and security researchers through the company’s Cyber ​​Verification Program, not to facilitate attacks. The reality of the Hacktron case shows that the same tool, in the hands of legitimate researchers or malicious actors, leads to the same results — the issue is now the processes and contexts of use, not the capability itself.

The Hacktron incident isn’t just an interesting proof-of-concept — it’s a clear indication of where cybersecurity is in 2026. When a widely available AI model can produce a memory-corruption exploit in a matter of hours, the imperative of rapid patching, tightly limited SSO scope, and layered defense design is no longer good practice — it’s a business requirement for survival.