A Three-Person Team Used Claude Opus 5 to Reach OpenAI's Internal Monorepo — and the Real Lesson Isn't the Image Bug

Last Updated: September 21, 2026

What actually happened

On July 25, 2026, researchers at Hacktron AI reported that they had compromised multiple OpenAI employees' ChatGPT accounts and, through them, reached internal OpenAI repositories. To prove access without reading anything sensitive, they instructed a compromised employee's Codex to open a pull request in OpenAI's internal monorepo, then stopped. TechCrunch reported that OpenAI paid a $6,500 bounty and has since resolved the issues.

The entry point was boring on purpose. OpenAI's community forum runs Discourse; Discourse's image checker didn't support HEIF, so it handed those files to ImageMagick's magick command for conversion, which exposed the underlying libheif parser to attacker-controlled input. Inside that parser was a heap buffer overflow reachable during HEIC decoding.

The model-upgrade datapoint, read honestly

The headline everyone is repeating is that Opus 5 did what Opus 4.8 couldn't. That's accurate, and it's worth being precise about the delta. Per Hacktron, Opus 4.8 found the missing backport and built a working exploit with ASLR disabled. What it failed at, across several sessions, was making that exploit reliable against Discourse's default configuration with ASLR on. In Hacktron's words: "Opus 4.8 struggled across several sessions to produce a working exploit with ASLR enabled." The evening Opus 5 shipped, a fresh session produced a working ARM64 exploit in about three hours, then ported it to the x86-64 and jemalloc environment Discourse uses.

So the step wasn't discovery. It was operationalization — the expensive, expert-scarce part of exploit development, the part that historically kept public bugs from becoming everyone's problem. That's a narrower claim than "Opus 5 hacks things," and a scarier one for defenders, because operationalization is precisely the cost curve that protected ordinary companies.

One anecdote across two models is not a benchmark. Different sessions, different prompts, accumulated context from prior attempts, and a vendor with a commercial interest in the result all argue for caution. But Hacktron reports a second jump in the same campaign — from Opus 5 to GPT-5.6 Sol — when exploiting blind, knowing nothing about the target beyond that it was vulnerable. Two steps in one research programme is a trend line, not noise.

For $200 a month, anyone can use these tools and hack into a company like OpenAI.

— Matt Fredrikson, CEO, Gray Swan, TechCrunch

The part that isn't about image parsing

If you take one operational lesson from this, don't make it "patch libheif." Hacktron is explicit that the escalation was not Discourse-specific — it was an OpenAI SSO issue, and compromising any first- or third-party service behind that SSO would have produced the same access. Discourse was just the door that happened to be unlocked.

That is the shape of the problem for anyone deploying agents. A Codex or ChatGPT account isn't a chat window; it's a credential aggregator. GitHub, Slack, email, internal tools — every connector a user attaches expands what one session token is worth. The agent then executes instructions on that user's behalf, with that user's authority, and every action looks like legitimate activity from a legitimate account. Session hijack plus connectors equals lateral movement with clean audit logs.

The CVE gap your scanner can't see

The libheif bug had already been fixed upstream. The commit wasn't labelled a security fix and received no CVE, which is Hacktron's explanation for why Debian 12 and 13 never got the backport in time — and why Discourse's Docker image shipped the vulnerable version. Discourse later published GHSA-vhm9-85gw-x335 (CVE-2026-32882) and added ImageMagick sandboxing as defense in depth.

If your vulnerability management is CVE-driven — and almost everyone's is — a silently fixed memory bug in a transitive dependency is invisible to you by construction. Hacktron's own patch guidance is worth repeating: a web-interface update may not replace the underlying container image; a rebuild is required. "We're patched" and "we redeployed the image" are different sentences.

Nobody saw it coming, literally

The quietest line in the Hacktron writeup is the most damning: across the broader campaign, they say they're not aware of any company that detected the activity except Shopify — even after thousands of images were sent and image processors repeatedly crashed. Segfaulting decoders are one of the cheapest intrusion signals available, and they were being thrown away as noise. If you run a media pipeline, crash telemetry from your converters belongs in your SIEM this week, not next quarter.

What to actually do

Four concrete moves, in the order I'd sequence them for a team running agents in production:

1. Map the untrusted-input-to-parser paths. Any endpoint accepting .heic, .heif, or .avif is in scope. Disable decoding you don't need, restrict accepted formats in ImageMagick's security policy, and isolate what remains in ephemeral sandboxes.

2. Re-scope agent connectors. Treat every OAuth grant to an AI assistant as a standing credential with the same review you'd give a service account.

3. Make model upgrades a change-control event. When a frontier model ships, your attacker's capability changed without your architecture changing. Re-run the red-team suite against the new model — both as attacker and as the model powering your own agents. We build this into integration engagements for exactly this reason.

4. Instrument the boring signals. Decoder crashes, unusual PR authorship, agent sessions acting outside normal hours.

The honest caveats

Hacktron sells AI security tooling; this is disclosure and marketing at once, and the campaign it advertises spans more targets than OpenAI. The researchers are elite CTF operators, not a median attacker. They're candid that this was not fully autonomous hacking and that skilled human guidance remained important. And the bounty came with a pointed footnote from OpenAI: testing against the Discourse-hosted forum was explicitly excluded from the bug bounty program, and the award recognises the OpenAI-side finding rather than the actions against Discourse. That is a scope dispute worth noticing — the industry has not settled who owns risk when a third-party property shares your identity plane.

None of that undoes the core result. As Hacktron founder Mohan Pedhapati put it on X, "AI is reducing the amount of scarce expertise needed to develop exploits." The defensive implication is unglamorous: your dependency hygiene and your identity boundaries now have to hold against attackers who rent expertise by the month. If you want a second pair of eyes on where your agent deployments actually grant authority, start here.