Three researchers from startup Hacktron AI didn’t need a state-sponsored budget to breach OpenAI’s defenses. They needed a $200 monthly subscription to Anthropic’s Claude and a clever chain of exploits. The team secured a $6,500 bug bounty after gaining access to multiple employee ChatGPT accounts, revealing how accessible advanced cyberattacks have become. This isn’t just about one company’s security lapse; it signals a shift where off-the-shelf AI models can automate complex vulnerability discovery.
The entry point was surprisingly mundane: an image upload on OpenAI’s community forum. The forum software, Discourse, used a library called libheif to process iPhone photo formats. A memory bug in that library allowed the researchers to inject malicious code. Crucially, this flaw had been fixed months prior by libheif developers but never received a CVE identifier, so Discourse remained vulnerable. It took the newly released Claude Opus 5 to stitch the exploit together. Previous version Opus 4.8 failed repeatedly, but Opus 5 succeeded within hours of its launch.
Once inside the forum server, the team pivoted to employee accounts linked to OpenAI’s GitHub organization. This cascade highlights a fragile dependency chain in modern tech stacks. Matt Fredrikson, CEO of Gray Swan, noted the broader implication: “If it can happen to them… it could happen to anyone.” The barrier to entry for sophisticated hacking is collapsing. What once required months of specialized expertise now takes days with the right AI assistant.
OpenAI has patched the issues, but the precedent is unsettling. While Anthropic restricted its newer Mythos 5 model over security concerns, Opus 5 faced no such limits. Meanwhile, open-weight models like Z.ai’s GLM-5.2 are rapidly closing the gap with frontier closed models. We are entering an era where defensive security must outpace not just human hackers, but automated agents running on consumer-grade subscriptions. The question isn’t if your stack has a hidden libheif-style bug, but whether an AI will find it before you do.
