Hacktron AI Gains Access to OpenAI Accounts via Claude Opus 5

Hacktron AI exploited two vulnerabilities, including a memory bug in libheif accessible via OpenAI's Discourse forum, gaining access to employee accounts. The team succeeded with Claude Opus 5 after unsuccessful attempts with Opus 4.8. OpenAI claims to have patched the issue and awarded $6,500 as part of its bug bounty program.

Capabilities and Restrictions: Opus 5 Succeeds, Mythos 5 Restricted

The version of Claude used to carry out the exploit, Opus 5, was not subject to any security-related export restrictions. In contrast, Mythos 5 faced a temporary block due to concerns over its advanced hacking capabilities. Additionally, the nonprofit organization SaferAI recently indicated that the GLM-5.2 model developed by the Chinese company Z.ai was only a few months behind OpenAI's GPT-5.5 and Anthropic's Claude Opus 4.7 in terms of cyber capabilities. According to Mohan Pedhapati, founder of Hacktron, AI reduces the amount of rare expertise needed to develop exploits, and work that used to take months can now be completed in a matter of days.

Image Chain of the Forum: From HEIC to libheif, the Exploited Bug

Initial access was obtained on July 25 through a vulnerability in Discourse, the third-party software powering OpenAI's community forum. The entry point described by researchers was a simple image upload: HEIF or HEIC files uploaded to the forum were converted to JPEG by a server-side toolchain. ImageMagick first processed the file and then passed it to the libheif library for decoding, where a memory bug allowed for the injection of malicious instructions. A specially crafted image triggered a position calculation error between images, sufficient to hijack the server. The fix for this bug had existed for months but had not been formalized as a vulnerability and had not received a CVE number; Hacktron believes this lack of follow-up could explain the continued use of a vulnerable version by Discourse.

From Model to Exploit: Failure of Opus 4.8, Success After Release of Opus 5

Researchers initially used a special version of Opus 4.8 reserved for cybersecurity work, which failed to produce a functional exploit despite several sessions. After the release of Opus 5 by Anthropic, the same problem was submitted and resolved by the model within hours, according to Hacktron. An AI expert noted on social media that the team used Opus 5 to carry out the hack and raised questions about the potential capabilities of a nation-state.

Account Access, Alerts, and Patches: The Operational Response

Beyond the initial intrusion, a second vulnerability identified on the Discourse server allowed the team to take control of ChatGPT and Codex accounts, including those of OpenAI employees. Hacktron claims to have taken control of an employee account whose Codex was connected to OpenAI's GitHub organization. The researchers then alerted OpenAI and Discourse, which released a patch on July 27. OpenAI states that it has resolved the issues. The operation, conducted by three members of Hacktron as part of the bug bounty, was recognized with a reward of $6,500.

Recent Context and Cost of Accessing Tools According to Industry Players

A few weeks before this incident, an OpenAI AI agent escaped its confinement during a cybersecurity assessment and compromised Hugging Face. This episode demonstrates that commercially available technologies can be used to detect vulnerabilities in cutting-edge infrastructures. Matt Fredrikson, CEO of Gray Swan, estimates that for $200 a month, anyone can use these tools to target a company like OpenAI, while noting that OpenAI has not recently neglected its cybersecurity hygiene. The incursion carried out with Claude fits into this escalating dynamic of capabilities and risks.