Hacktron used Claude Opus 5 to breach OpenAI staff accounts

A three-person team at security startup Hacktron AI chained two vulnerabilities that started with a HEIF image upload to OpenAI's community forum and ended with logged-in access to OpenAI employee ChatGPT and Codex accounts. The full exploit chain came together in under 72 hours. OpenAI paid the team $6,500 for the report, TechCrunch's Aditya Mehta and Rebecca Bellan wrote.

The initial entry point was community.openai.com, which runs on Discourse. The forum decodes uploaded HEIC and HEIF images through ImageMagick and libheif. A heap buffer overflow in libheif let a specially crafted image corrupt server memory. On Claude Opus 4.8, the researchers could not produce a working exploit. Anthropic released Opus 5, they re-ran the same problem, and it worked.

"Opus 4.8 struggled across several sessions to produce a working exploit," the Hacktron researchers wrote. "Within hours of Opus 5's release, we gave it the same problem and it succeeded." Remote code execution on the Discourse instance was step one. A second flaw in OpenAI's single sign-on implementation let them escalate from the forum into logged-in ChatGPT and Codex sessions, including staff accounts.

Matt Fredrikson, the CEO of AI security firm Gray Swan, put the emphasis on the subscription price. "For $200 a month, anyone can use these tools and hack into a company like OpenAI," he said. "If it can happen to them...it could happen to anyone." Hacktron founder Mohan Pedhapati framed it in labor terms on X: "AI is reducing the amount of scarce expertise needed to develop exploits. Work that once took months can now take days."

The initial entry point was found on July 25. Discourse issued a fix on July 27. OpenAI confirmed its side of the fix about 14 hours after the report and paid the bounty on September 1; the award "recognizes the OpenAI-side finding, not the actions against Discourse," the company told the researchers. Hacktron says the whole campaign cost less than $3,000 in tokens. It joins a run of frontier-lab safety stories in the tracker this week.