Claude Opus 5 Builds OpenAI Exploit Chain: From 72 Hours to…

Three Hacktron researchers used Anthropic's newly released Claude Opus 5 to develop a full exploit chain against OpenAI's Discourse forum, pivoting from a heap overflow in libheif to internal repository access via an SSO misconfiguration — all in under 72 hours and for less than $3,000 in AI compute costs.

On July 25, 2026, three Hacktron researchers completed an exploit chain against OpenAI's infrastructure, developing the payload with Claude Opus 5 — Anthropic's model released that same day. In under 72 hours they moved from discovering a heap overflow in libheif to opening a pull request in the internal openai/openai monorepo, demonstrating that AI offensive capabilities advance not gradually but in discrete leaps that defense calendars cannot anticipate.

Key Takeaways

Claude Opus 4.8, tested in prior weeks, failed to bypass ASLR; Opus 5 produced a working ARM64 exploit in 3 hours and the x86-64/jemalloc port by the morning of July 25.
The chain exploited CVE-2026-32882 in the libheif 1.19.7 HEIF parser on Debian 12, triggered via the Discourse forum's ImageMagick fallback.
An OpenAI SSO misconfiguration allowed forum authentication tokens to grant full API access to users' ChatGPT and Codex accounts without additional interaction.
The HEIF Heist campaign cost under $3,000 in AI tokens; OpenAI paid a $6,500 bounty for the SSO flaw alone, with the forum RCE outside the bug bounty scope.

From Opus 4.8 to Opus 5: A Wall, Then a Door

Hacktron researchers had begun testing Claude Opus 4.8 weeks earlier. The prior model achieved remote code execution with ASLR disabled but "hit a wall" bypassing address-space randomization, according to the Hacktron report. The transition to Opus 5, released the evening of July 24, shifted the outlook: within 3 hours the model generated a working ARM64 exploit; by 6 a.m. on July 25 the payload had been ported to x86-64 with the jemalloc allocator used by OpenAI's Discourse instance.

The technical leap is not gradual. Opus 4.8 and Opus 5 separate a missing capability from a working one, with no intermediate zone. This pattern, which researchers call "capability overhang," indicates AI models can appear constrained for months and then cross a critical threshold in a single update, rendering risk assessments based on prior testing obsolete.

The Technical Chain: From Heap Overflow to Codex Control

The vulnerability resides in libheif 1.19.7, the HEIF parsing library included in the Discourse Docker image based on Debian 12. The commit that fixed the defect, 85e21ad44 with the message "simplify overlay overlap area computation," had been applied upstream a year earlier but was not documented as a security fix nor assigned a CVE. Researchers triggered the bug via the ImageMagick fallback path for HEIF uploads on OpenAI's Discourse forum.

From that point, RCE on the forum server should not have propagated to core infrastructure. But OAuth tokens generated for community forum authentication carried excessive permissions: per OpenAI's statement to SecurityWeek, they granted "full API access to associated ChatGPT and Codex accounts." For active forum users — including OpenAI employees — this meant forum token compromise translated into a zero-interaction takeover of their production accounts.

Researchers demonstrated impact by opening pull request #1186742 in the internal openai/openai monorepo through an employee's Codex account, without reading sensitive code. The Wall Street Journal independently verified that researchers had the actual ability to read and propose changes to OpenAI's internal software.

"AI is eliminating the protection of security through complexity. It is converting once-scarce hacker expertise into cheap compute."
— Hacktron AI incident report conclusion, per Finance BigGo

OpenAI's Response and the Economic Gap

OpenAI confirmed the SSO fix at 22:49:45 UTC on July 25, 2026, roughly 14 hours after disclosure. The spokesperson told SecurityWeek: "We narrowed the permissions on Community sign-in tokens and revoked affected tokens and sessions." Discourse patched the libheif flaw within two days and added Landlock sandboxing as defense-in-depth, per commit a071880.

The bounty OpenAI paid for the SSO misconfiguration was $6,500. The forum RCE test fell outside the bug bounty program scope, so that component went unpaid. The full HEIF Heist campaign — which included testing against Slack, Meta, Zoom, Shopify, GitHub Enterprise, and frameworks like Next.js, Astro, and Gatsby — cost under $3,000 in AI tokens, according to Hacktron CTO Mohan Pedhapati as cited by Finance BigGo.

The gap is stark: under $3,000 in compute to build capabilities that traversed production defenses with ASLR and modern allocators, versus $6,500 bounty for a flaw that could have enabled internal repository access. Joshua Saxe, CTO of Abundant Security, summarized: "Global software is riddled with security vulnerabilities. The reason we haven't found all of them is that until last year, only a few thousand people were truly skilled at finding vulnerabilities. Now, AI agents are democratizing this capability to people with lower technical skill levels."

What We Know and What the Dossier Does Not Document

The technical dossier leaves several points unaddressed. It does not indicate whether malicious actors exploited the same chain before Hacktron's disclosure. The exact number of employee accounts potentially exposed by the SSO misconfiguration has not been made public. It is unknown whether OpenAI's internal reviews found traces of prior exploitation beyond PR #1186742.

The specific methodology by which Opus 5 bypassed ASLR has not been disclosed for responsible disclosure reasons. The official CVSS score from NVD or the Discourse CNA for CVE-2026-32882 is not available; Red Hat published a preliminary 7.1 HIGH rating with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H, which however does not include code execution in its preliminary analysis. It is not documented whether Anthropic modified Opus 5's safety guardrails following the incident.

What to Do Now

Audit OAuth token permissions in perimeter SSO flows: tokens issued for community or forum services must be scoped to minimum privileges, especially when linked to production accounts with API access.
Review media-parsing dependencies in exposed deployments: libraries like libheif, ImageMagick, and their fallbacks constitute attack surface for format-specific exploits; commit 85e21ad44 shows existing fixes can remain invisible without a CVE.
Recalibrate bounty models on escalation potential: when compromise of a perimeter service translates to internal repository access, the bounty evaluation framework must reflect the real chain impact, not just the entry flaw.
Test AI models against your own assets before others do: the discontinuity between Opus 4.8 and Opus 5 indicates offensive capability evaluation cycles must sync with model releases, not traditional audit calendars.

Why This Changes the Security Perimeter

This incident is not a malicious compromise nor a demonstration of autonomous AI. It is a publicly shared bounty disclosure that reveals a deeper dynamic: the complexity that has so far protected global software — the scarcity of expertise in bypassing ASLR, calculating heap offsets, building RCE chains — is becoming a compute commodity. The result is that exploit development time collapsing from weeks to hours translates into an attack velocity that patch cycles and bounty programs are not structured to absorb.

The federated identity problem amplifies the effect. When a forum token grants full API access to ChatGPT and Codex, the boundary between perimeter attack surface and critical infrastructure dissolves. Community services, forums, support instances become mandatory pivots not for their intrinsic sensitivity, but for the trust relationships they retain with core systems. The lesson is not that OpenAI was "hacked": it is that trust configuration across federated services requires redefinition when the attacker can build the exploit overnight.

FAQ

Did the Claude model act autonomously?

No. Researchers describe the operation as AI-assisted, not autonomous: "skilled human guidance" remained essential for orchestration and targeting. Claude Opus 5 was used as a payload generation tool, not an independent agent.

Did researchers steal source code or model weights?

No. Per the Hacktron report, researchers stopped at opening a harmless pull request (#1186742) and did not read sensitive code. No data exfiltration is documented.

Was the vulnerability in OpenAI's AI model?

No. The flaw was in libheif 1.19.7, a third-party dependency in OpenAI's Discourse forum, combined with an OpenAI-side SSO misconfiguration. OpenAI's AI models were not compromised or manipulated.

Information verified against cited sources and current as of publication.

Sources

Sources and references

Get DeafLetter