AI hacked OpenAI: How Claude Opus 5 breached internal repos for under $3,000
Hackers used Claude Opus 5 to write a zero-day exploit, breaching OpenAI internal GitHub repos through a simple forum image upload.
Research · Source: Hacker News
What happened
Security researchers at Hacktron AI compromised OpenAI internal GitHub repositories. The team discovered a heap buffer overflow in libheif. This is an image processing library used by the Discourse software running the OpenAI community forum. They chained this vulnerability with an SSO misconfiguration. This allowed them to hijack employee ChatGPT and Codex accounts.
The researchers used Anthropic models to write the actual exploit. Older models failed to bypass memory protections like ASLR. The newly released Claude Opus 5 solved the problem in hours. The team bypassed safety filters by proxying the target to make it look like a hacking competition.
The exploit gave them remote code execution on the forum server. From there, they used an employee Codex account to open a harmless pull request in the OpenAI monorepo. They stopped testing and reported the flaw. OpenAI patched the issue in 14 hours and paid a 6,500 dollar bounty.
Key facts
- $6,500 — Bounty paid by OpenAI for the vulnerability
- < $3,000 — Total API token cost for the two-month research campaign
- 14 hours — Time it took OpenAI to fix the SSO issue
- Opus 5 — Anthropic model used to successfully write the exploit
Why it matters
Security through complexity is officially dead. Builders can no longer assume obscure memory corruption bugs are too hard or expensive for attackers to exploit. AI models now turn raw compute into elite hacking expertise. If your application processes user uploads, a cheap AI agent can write a custom exploit for your specific server environment in a matter of days.
The economics of zero-day attacks just flipped completely. The research team spent less than 3,000 dollars in API tokens to breach multiple tech giants over a two-month campaign. We are going to see a massive spike in automated attacks against standard web frameworks. Startups must assume their infrastructure is being actively probed by highly capable models like GPT-5.6 Sol.
For builders
Sandbox your image processing pipelines now
Do not trust user uploads under any circumstances. If your app accepts HEIC or AVIF files, isolate the decoding process in an ephemeral sandbox. Startups relying on default Docker images will pay the ultimate price when automated agents find unpatched dependencies.
Audit your SSO integrations across all apps
This breach escalated because a simple forum login granted access to internal coding tools. Map out exactly what your SSO tokens can touch. Founders lose their entire intellectual property when a low-priority community forum compromises their core production repositories.
Update libheif and libde265 dependencies immediately
Check your system dependencies today. You must update to the latest upstream security patches like version 1.23.4. Companies ignoring underlying C libraries in their Node or Ruby stacks are sitting ducks for AI-generated memory exploits.
My take
OpenAI getting breached by researchers using Anthropic models is peak industry irony. But the real story is the terrifying drop in exploit costs. Elite zero-day hacking now costs less than a used car. If you build AI products today, you must assume autonomous agents are already probing your endpoints for obscure library flaws.
Original reporting: Hacker News. This is my rewrite and opinion.