Three people at the security firm Hacktron AI got into OpenAI’s internal code repository in July. Their tool was Claude Opus 5. This week they published how they did it, the Wall Street Journal picked it up, and the story has been running through the tech press since.
From a forum image to a GitHub account
The way in was OpenAI’s community forum, which runs on Discourse. The researchers uploaded a doctored HEIF image. Processing it server-side pushed an outdated build of the libheif library into a heap overflow, and they turned that memory crash into code execution on the forum server.
Session handling carried them the rest of the way. They pulled session tokens out of the forum database, and OpenAI’s sign-in did not properly isolate forum sessions from its other services. That got them an OpenAI employee’s account — one whose Codex was connected to the company’s GitHub organisation. GitHub, Slack and email followed. As proof, they opened a harmless pull request in the private repository.
That repository holds the monorepo where OpenAI keeps its code.
Opus 4.8 failed, Opus 5 didn’t
The most interesting line in the researchers’ writeup isn’t about OpenAI at all. It’s about models: “Opus 4.8 struggled across several sessions to produce a working exploit. Within hours of Opus 5’s release, we succeeded.”
They worked with a version of Claude cleared for security research, where the usual restrictions are relaxed. Reading the memory structures and writing the weaponised exploit code from them was the model’s job.
$6,500 and a few hours of patching
They found the flaw on 25 July and told OpenAI and Discourse on 27 July. Discourse shipped the fix; OpenAI closed the holes within 14 hours of being notified, according to Tom’s Hardware. OpenAI paid out $6,500 from its bug bounty programme.
For full access to the code repository of one of the most expensive companies on earth, that is a modest number.
The subscription costs less than the defence
Matt Fredrikson, CEO of Gray Swan, says the line that sticks: “For $200 a month, anyone can use these tools and hack into a company like OpenAI.”
That’s the actual story. Not that a forum was running an old image library — that happens. It’s that the chain from memory bug to exploit to privilege escalation is now handled by a subscription anyone can buy. Anthropic’s September threat report describes the same capability from the other side, where the people using it meant harm.
Here, they told someone first. That’s the entire difference, and it rests on nothing but intent.
Sources: