From Opus 4.8 to Opus 5 in Hours: How an AI-Built Exploit Reached OpenAI’s Internal Code

A three-person security team says it went from a forum image upload to OpenAI’s internal code repository in less than 72 hours, and that an AI model did much of the hardest work. In a report published September 13, 2026, Hacktron AI describes a coordinated, bug-bounty-reported attack chain against OpenAI. The most telling detail is not the bug itself but how fast the exploit came together once a newer model arrived: Claude Opus 4.8 could not make the exploit reliable across several sessions, and Claude Opus 5 did it within hours of its release.

What happened, briefly

OpenAI runs its community forum, community.openai.com, on Discourse and lets people sign in with their OpenAI account. Hacktron found that Discourse passed HEIC/HEIF image uploads to ImageMagick and the libheif decoder, and that the libheif version in Discourse’s Debian-based image lacked a fix for a heap buffer overflow. That gave the team code execution on the forum. A separate misconfiguration in OpenAI’s single sign-on then let them take over the ChatGPT and Codex accounts of active forum members without any action from those users.

To prove impact without reading internal code, the researchers used an OpenAI employee’s Codex account, which was connected to OpenAI’s GitHub organization, to open a harmless pull request in OpenAI’s internal monorepo, and then stopped. They reported through OpenAI’s Bugcrowd program. OpenAI confirmed a fix about 14 hours after the report, and Discourse shipped a patch with added image-processing sandboxing two days later. OpenAI paid a $6,500 bounty and stated that testing against the Discourse-hosted forum itself was outside the program’s scope.

The model jump is the story

Hacktron’s timeline shows how the capability gap closed:

• July 23: the team starts reviewing Discourse’s image pipeline. An Opus 4.8 session inspecting the Docker image spots that certain libheif security fixes were never backported.
• July 24: Opus 4.8 produces a working exploit with ASLR disabled. Several further sessions fail to make it work with ASLR enabled, the realistic configuration.
• Evening of July 24: Claude Opus 5 is released. A fresh session builds a working ARM64 exploit on a local Mac within about three hours, then ports it to Discourse’s x86-64 and jemalloc setup.
• Morning of July 25: an autonomous agent loop reaches code execution on a Discourse Cloud test instance the team controlled. The same exploit then works against OpenAI’s forum.

The write-up also notes a guardrail detail: the model refused to write exploits for remote instances, so the team routed its own test instance through a proxy that made it look like a capture-the-flag target. Later in the broader campaign, Hacktron says it saw another clear step up from Opus 5 to GPT-5.6 Sol when exploiting targets it knew almost nothing about.

What it cost

According to Hacktron, the OpenAI and Discourse work took a few days of agent time and only a few hours of human time. The wider project it calls “HEIF Heist,” which traced the same decoder through Slack, Meta, GitHub Enterprise, Ruby on Rails and several JavaScript frameworks, ran for two months with three researchers and cost less than $3,000 in tokens. Adapting the exploit to each new company usually took one or two days. The team stresses that this was not fully autonomous hacking and that skilled human guidance still mattered.

What this means for AI companies

Three lessons stand out for AI providers and anyone building on them:

• Identity is the blast radius. Hacktron points out that the escalation was an OpenAI SSO issue, not a Discourse problem: compromising any service that uses OpenAI sign-in could have led to the same access. As assistants gain connectors to GitHub, Slack and email, a single account takeover reaches much further than it used to.
• Agents with repo access are a new privilege. The proof of impact was a prompt to a coding agent, not a stolen password. Connected agent accounts deserve the same scrutiny as privileged human accounts.
• “Too hard to exploit” is no longer a defense. Hacktron argues that complexity used to protect ordinary companies because turning a known bug into a reliable exploit needed rare skill and time. AI turns more of that expertise into compute, so threat models built on older assumptions about attacker capability will underestimate risk.

The report also cuts the other way. The same capability let a small, disclosure-minded team find and help fix the problem within a day. Only one target in the wider campaign, Shopify, is reported to have noticed the activity, which suggests detection has not kept pace with offense.

Practical steps

• Patch libheif and libde265 (upstream libheif v1.23.4 was the latest security release as of September 14, 2026) and rebuild self-hosted Discourse.
• Disable server-side HEIF/AVIF decoding where it is not needed, and sandbox image processing.
• Audit which apps can sign users in through your identity provider, and scope tokens for connected AI agents as narrowly as possible.

Source: Hacktron AI, “Hacking OpenAI” (September 13, 2026).