Hacktron AI uses Claude Opus 5 to exploit OpenAI's security vulnerability

OpenAI was somehow "hacked" by the Claude model!

A security team of only three people used Claude to breach a ChatGPT account belonging to an OpenAI employee within less than 72 hours, gaining access to OpenAI’s internal private code repositories.

And all they spent was a few dozen dollars on an Opus 5 subscription.

This is another epic system vulnerability case.

This is just too darkly ironic.

Not long ago, a startup security team called Hacktron AI participated in OpenAI’s bug bounty program.

Their ultimate weapon is Anthropic's newly released Opus 5.

No one expected success to be so easy.

This team of three successfully gained control of a ChatGPT and Codex account belonging to an OpenAI employee by exploiting the completely unsecured Opus 5.

Immediately afterward, they boldly entered OpenAI’s most sensitive and confidential area—the internal monorepo containing core algorithms and proprietary code.

To prove they had been there, the team did something provocative.

They submitted a harmless PR to the internal codebase using Codex credentials belonging to an OpenAI employee.

After receiving the report, OpenAI’s security team broke into a cold sweat and urgently patched the vulnerability within 14 hours, paying a $6,500 bounty to the three-person team.

As soon as the news broke, the industry was stunned: “Unbelievable! OpenAI’s headquarters have been raided by a rival!”

Someone posed a profound question: “If three ordinary people plus a Claude subscription can achieve this, what could state-sponsored hackers accomplish with AI?”

This lightning-fast attack, lasting less than 72 hours, featured a highly artistic chain of actions by the team.

They did not rely on brute force; instead, like the most patient hunters, they gradually infiltrated the core from the most unassuming corner on the periphery.

The entire attack chain can be broken down into the following nine critical stages.

Find Achilles' heel (community forum)

OpenAI's security defenses are impenetrable; directly attacking the core servers is nearly impossible.

However, the Hacktron team discovered a breakthrough: the community forum used by OpenAI for user communication (community.openai.com).

This forum is built on the open-source software Discourse and supports single sign-on (SSO) using an OpenAI account.

A hidden time bomb (libheif vulnerability)

While analyzing the forum's image upload feature, they discovered an extremely obscure but critical flaw.

Typically, the forum uses FastImage to check images, but it does not support HEIF/HEIC images commonly used by Apple. As a result, the system routes these images to ImageMagick, which invokes the underlying libheif image decoder.

Worse still, the system based on the Debian 12 image has libheif version 1.19.7 installed, which contains a heap buffer overflow vulnerability.

Bypass AI safeguards to forge a divine weapon

The Hacktron team did not write exploit code manually; instead, they used Claude Opus 5.

To bypass Opus 5's security safeguard that prohibits writing exploit code for real targets, they pulled a trick: disguising their test server as the target domain for a CTF (Capture the Flag) competition (rce.ee/ctf-forum).

Opus 5, thinking they were just playing a game, has now gone all out.

Upload a "poisoned image" to gain remote code execution (RCE)

They uploaded a carefully crafted HEIF malicious image to the forum. The moment the image was parsed in the background, the buffer overflow vulnerability was triggered, allowing the Hacktron team to gain remote code execution access to the OpenAI community forum environment.

Critical authentication vulnerability (SSO)

The forum hack was just the first step. Due to a misconfiguration in OpenAI's SSO (Single Sign-On) authentication, identity tokens of any user who logged into the forum may have been stolen.

Compromise internal employee ChatGPT/Codex accounts

Through the aforementioned SSO vulnerability, the team successfully took over the ChatGPT and Codex accounts of multiple OpenAI employees.

Follow the vine to find the melon, strike at the heart of the enemy

OpenAI employees typically deeply integrate Codex with internal productivity and development tools such as GitHub, Slack, and Outlook.

Breach the internal code repository

Using the compromised employee account, the Hacktron team gained direct access to OpenAI’s core monorepo.

Leave a mark, silently accomplish great deeds

Submit PR #1186742, then halt all testing and submit a vulnerability report to OpenAI.

From an ordinary HEIC image to OpenAI’s internal core secrets database, Opus 5 somehow bridged this seemingly impossible path.

If the vulnerability itself was sophisticated enough, the pace of AI evolution demonstrated in this attack has instilled fear in all cybersecurity professionals.

Two days before the attack, on July 23 of this year, the Hacktron team had already discovered this vulnerability.

At the time, they were using Anthropic’s previous-generation model, Claude Opus 4.8.

Under the default defense environment with ASLR enabled, Opus 4.8 struggles somewhat.

ASLR, or Address Space Layout Randomization, is a security mechanism that enhances system protection by randomly arranging the addresses of key memory regions when a process is loaded.

The team attempted multiple sessions, but Opus 4.8 consistently failed to generate stable exploit code.

The turning point occurred on the evening of July 24—Anthropic officially released Claude Opus 5.

Armed with their new weapon, the Hacktron team immediately launched a new Opus 5 session.

Miracle happened: Within the first three hours, Opus 5 successfully wrote attack code targeting the ARM64 architecture for local Macs.

Subsequently, the team requested that it port the code to the x86-64 environment and jemalloc memory allocator used by the Discourse forum.

Just one night later, at 6:00 AM on July 25, Opus 5 confirmed the effectiveness of local RCE via image upload.

By 10 a.m., the Opus 5 agent, configured with an autonomous cycling objective, had successfully breached the cloud instance and accessed the system’s底层 files.

The new model cracked and automatically exploited vulnerabilities that the previous model couldn't find—all within a day of its release!

A harsh reality is that the leap in AI model capabilities is exponentially lowering the barrier to cyberattacks.

In subsequent extensive testing, the team even found that, using the updated GPT-5.6 Sol model, the AI could autonomously perform an end-to-end attack—including memory leakage, privilege escalation, lateral movement, and bypassing existing defenses—even under extreme blind conditions where it had no knowledge of the target system other than the existence of a vulnerability.

This capability once belonged only to top-tier nation-state hackers.

Do you think only OpenAI is having bad luck? You're absolutely wrong.

The Hacktron team named this discovery the "HEIF Heist."

The terrifying aspect of this vulnerability is that it is not unique to OpenAI, but rather a symptom of the open-source dependency crisis affecting the entire internet infrastructure.

Every day, we upload countless images online, and the open-source library libheif, used to parse HEIC/HEIF/AVIF images, is deeply embedded in numerous nationwide applications.

Even more frustrating is that a fix for this vulnerability was already implemented in a branch on the open-source community last year, but because it was not labeled as a security patch (no CVE ID was assigned), countless downstream operating systems and software remain unaware of it!

Over the following months of investigation, the Hacktron team used AI as an automated hacker to conduct a sweeping operation against major internet corporations.

They found: Slack, Zoom, Meta, GitHub... these household-name tech giants, as long as they accept image uploads, are almost all compromised!

Whether it's Ruby on Rails or popular frameworks in the Node.js ecosystem such as Next.js, Astro, or Gatsby, any application that calls this library can be easily compromised.

The cost is even astonishingly low.

The Hacktron team stated that the entire "HEIF Heist" research project took two months and covered all the aforementioned giants, with their total large model token costs amounting to less than $3,000!

For each different tech company, AI can adapt "poisonous images" into customized attack tools within just one to two days, based on the target company’s environment.

After throwing thousands of test images at them, the image processors of major companies repeatedly crashed—only Shopify noticed the anomaly; all other internet giants remained completely unaware!

This is a microcosm of the fragility of the modern internet: as the famous xkcd comic satirizes, all modern digital infrastructure teeters precariously on a small, vulnerable open-source library maintained by an unknown programmer.

They then reported the vulnerability to Discourse and OpenAI.

Approximately 14 hours after the initial report, OpenAI resolved the single sign-on (SSO) issue, followed by Discourse.

This vulnerability report, with a reward of only $6,500 (approximately less than 50,000 RMB), is destined to become a watershed moment in cybersecurity history.

For a long time, the software industry has enjoyed an invisible shield—“security through complexity.”

In the past, even if a vulnerability in an open-source codebase was made public and the source code was right on the table, ordinary hackers could not exploit it.

Turning a theoretical memory corruption vulnerability into a practical weapon capable of compromising a server requires extremely rare expertise, significant time investment, and deep reverse engineering of the target environment.

In the past, this top-tier vulnerability weapon, known as a 0-Day, carried an extremely high development cost and was typically only pursued by state-sponsored hacker teams targeting high-value objectives. Ordinary enterprises could rely on this high attack cost as a form of security.

However, AI has personally torn apart this umbrella of protection.

Hacktron wrote at the end of the report:

AI is eliminating this protection, transforming once-scarce hacking expertise into inexpensive computational power. Attacks that once required a well-funded team months to execute are now compressed into just a few days—or even hours.

Today, any team of three individuals with access to advanced, unregulated AI can unleash security penetration capabilities rivaling those of national teams.

If your company still relies on "hackers won't target us" as a defense, you could be the next to have your core codebase compromised.

This article is from the WeChat public account "New Intelligence Yuan" (ID: AI_era), authored by ASI Revelation.