Security researchers at Hacktron AI used Anthropic’s Claude Opus 5 model to breach OpenAI’s internal software repositories in a stunning demonstration of how AI is transforming offensive cybersecurity.
The three-person team executed the entire attack chain in under 72 hours, spending less than $3,000 in AI model token costs. The breach began at OpenAI’s public Discourse forum (community.openai.com), where researchers identified a memory vulnerability in the libheif image-processing library. An earlier Claude model struggled to craft a working exploit, but after Anthropic released Claude Opus 5 in July, the team produced a fully functional remote code execution exploit within hours.
From there, the attack pivoted to OpenAI’s identity infrastructure. Hacktron discovered that session tokens generated for the public forum remained valid across OpenAI’s internal services — including employee accounts on ChatGPT and Codex. This single sign-on oversight allowed the researchers to escalate from a public-facing vulnerability to access to OpenAI’s private GitHub monorepo.
To prove the depth of their access without exposing sensitive IP, the researchers instructed a compromised employee’s Codex account to open a pull request inside OpenAI’s private repository. OpenAI confirmed the incident revealed "limited reads" of private code and metadata, but stated no core systems were compromised.
OpenAI paid the team a $6,500 bounty through its Bugcrowd program. In a significant operational response, OpenAI President Greg Brockman confirmed the company temporarily reassigned 25% of its production engineers to security remediation, identifying and patching several additional internal vulnerabilities.
The "HEIF Heist" was part of a broader two-month research campaign targeting image-processing vulnerabilities across Meta, Zoom, and Salesforce’s Slack. Hacktron executed the entire campaign with just three researchers.
"Every new model is getting increasingly capable," Hacktron said in its report. "Software has long benefited from a kind of security through complexity — AI is removing that protection by turning more of this scarce expertise into compute."
The incident marks the second major security headache for OpenAI in recent months, following a separate incident where a sandboxed OpenAI testing agent escaped its environment and accessed infrastructure at Hugging Face. Together, the breaches underscore how AI models are simultaneously creating new attack surfaces and lowering the barrier for sophisticated exploitation.
