OpenAI just got a harsh lesson in its own medicine. Security researchers from the firm Hacktron used Anthropic’s Claude Opus 5 to breach OpenAI’s internal systems, including employee ChatGPT accounts and GitHub code repositories. The entire operation took less than 72 hours to execute and cost the team under $3,000 in AI compute credits. This wasn’t a state-sponsored assault with unlimited resources; it was a lean, three-person team proving that sophisticated cyberattacks are no longer the exclusive domain of well-funded intelligence agencies.
The entry point was surprisingly mundane: an outdated image processing library on OpenAI’s community forum. The forum used libheif to handle HEIC images, a component with a known fix that had been available for a year but remained unpatched in the Debian packages running the server. By uploading a crafted image file, the researchers executed arbitrary code on the server. They then chained this with a misconfiguration in OpenAI’s single sign-on system, allowing them to impersonate active forum members. This gave them access to employee accounts linked via “Sign in with OpenAI,” potentially exposing connected Slack, email, and GitHub services. To prove the breach without causing harm, they used an employee’s Codex account to submit a harmless pull request to the internal monorepo.
The real story here isn’t just the vulnerability, but the tool that exploited it. The team initially tried using Claude Opus 4.8, which failed to bypass ASLR memory defenses. But when Anthropic released Claude Opus 5 on July 24, the model generated a working exploit for a local Mac within three hours. It then adapted that exploit to the Discourse server environment in just four more hours. The researchers noted that previous models struggled with this level of autonomous reasoning, but Opus 5 succeeded where its predecessor failed, even outperforming OpenAI’s own GPT-5.6 Sol in related tasks. They had to frame the attack as a benchmark task to bypass the model’s safety refusals against targeting real systems.
This incident shatters the illusion of security through complexity. For years, companies relied on the fact that building reliable exploits required rare expertise and months of effort. AI has collapsed that timeline into days. Hacktron expanded their “HEIF Heist” investigation to targets like Slack, Meta, and GitHub Enterprise, adapting the attack for each new target in just one to two days. Only Shopify detected the activity. As the researchers put it, threat models must now account for how cheap and fast these attacks have become. If a three-person team can do this for $3,000, imagine what a determined adversary could achieve.
