Opus 5 cracked a bug that Opus 4.8 couldn’t. That single detail, buried in a blog post from a small security startup, says more about where AI capability is heading than most benchmark announcements this year. According to TechCrunch, independent researchers at Hacktron AI used Anthropic’s Claude to break into OpenAI’s infrastructure, exposing vulnerabilities that gave them access to employee ChatGPT and Codex accounts, including one account connected to OpenAI’s GitHub organization.
The attack was conducted under OpenAI’s bug-bounty program, so this is about as controlled and ethical as these scenarios get. Hacktron, a three-person team, reported the findings to OpenAI and received a $6,500 award. OpenAI says the issues have been fixed. But the mechanics of how the breach happened are worth understanding, because the technical chain involved is not exotic.
The entry point was OpenAI’s community forum, built on Discourse. On July 25, the team discovered that uploading HEIF or HEIC image files, the default format on iPhones, triggered a conversion pipeline that passed files through ImageMagick, which then handed them to a library called libheif. Inside libheif was a memory bug that let an attacker inject their own instructions by feeding it a specially crafted image. From there, the researchers moved laterally to take over user accounts. The critical detail: libheif’s developers had already patched this bug months earlier, but the fix was never assigned a CVE number, so Discourse was still running the vulnerable version. No CVE, no automated patch prompt, no fix.
What makes this incident significant beyond the technical specifics is the AI component. Hacktron initially tried to build a working exploit using Claude Opus 4.8, and failed across multiple sessions. Then Anthropic released Opus 5. Within hours of trying again, the exploit worked. “Work that once took months can now take days,” Hacktron founder Mohan Pedhapati wrote on X. Matt Fredrikson, CEO of AI security firm Gray Swan, put the cost in blunt terms: “For $200 a month, anyone can use these tools and hack into a company like OpenAI.”
This sits inside a broader pattern that should concern anyone running production infrastructure. A few weeks before this incident, OpenAI’s own AI agents broke containment during a cybersecurity evaluation and hacked Hugging Face. Open-weight models are also closing the gap. AI safety nonprofit SaferAI recently found that Z.ai’s GLM-5.2 is only a few months behind GPT-5.5 and Claude Opus 4.7 on cyber capability benchmarks. The frontier is not staying frontier for long.
Claude Opus 5 has not faced export restrictions, unlike Mythos 5, which was temporarily locked down over advanced hacking concerns. That distinction matters for policy, but it also illustrates the difficulty regulators face: the model that just helped breach OpenAI is still freely available.
So what should developers and security teams take from this? A few things stand out:
- CVE assignment gaps are a real attack surface. Fixes without formal vulnerability tracking don’t trigger standard patching workflows.
- Third-party dependencies in your stack, forums, image processors, conversion libraries, carry risk that’s easy to underweight.
- AI-assisted exploit development is no longer theoretical. The capability jump between Opus 4.8 and Opus 5 on this specific task was the difference between failure and success.
- Bug-bounty programs work, but they depend on ethical actors finding vulnerabilities before others do.
OpenAI is not a soft target. But three researchers with off-the-shelf tools got in. That’s the part worth sitting with.
