Did Claude Hack OpenAI? The Real Story of HEIF Heist and the $3,000 Break-In

On the evening of September 17, security startup Hacktron AI disclosed that back in July, three of its researchers broke into OpenAI — employee ChatGPT and Codex accounts, with reach into connected GitHub, Slack, and Outlook — in under 72 hours, proving it with a pull request in OpenAI's internal codebase. The tool that wrote the working exploit: Anthropic's Claude Opus 5. (Disclosure, per The Receipts Standard: this site is produced with Claude-family tools, which makes this a flattering story about our own toolchain — so everything below leans on Hacktron's published writeup, the CVE record, and named sources, and we'll say plainly where the headline flatters too much.)

The chain, in plain English

Step one: OpenAI's community forum runs Discourse, and Discourse's image pipeline used a stale version of libheif — the open-source library that decodes HEIF/HEIC images (the format your iPhone photos use). A single malformed image was enough to get code execution on the forum server. That became Discourse advisory CVE-2026-32882, rated 8.8/High.

Step two: a single-sign-on bug let the researchers pivot from that foothold into OpenAI employees' ChatGPT and Codex accounts — and from there into the services wired to them: GitHub, Slack, Outlook. To prove access without touching anything sensitive, they opened a harmless pull request inside OpenAI's internal codebase. Total elapsed time from first bug to internal-PR proof: under 72 hours.

The detail that actually matters: Opus 4.8 couldn't, Opus 5 could

Here's the part worth pausing on. The hardest step — a memory-corruption exploit that defeats a standard defense called ASLR — was something the researchers first tried to build with Claude Opus 4.8, and it failed. Their writeup is blunt: 'Opus 4.8 struggled across several sessions to produce a working exploit with ASLR enabled.' Then, per Hacktron: 'within hours of Opus 5's release, we gave it the same problem and it succeeded.'

That is a capability threshold crossed in public, on a live target. Same team, same target, same problem — and a single model generation flipped an unsolved exploit into a solved one. Benchmark leaderboards argue over decimal points; this is the binary version, where the exploit either works or it doesn't. Opus 5 is the model that made it work — which is exactly why the researchers, not the marketing department, are the ones telling this story.

One tiny library, an enormous blast radius

The forum bug wasn't a one-off. The same libheif research — which Hacktron branded 'HEIF Heist' — turned up issues affecting Slack, Meta, GitHub Enterprise, Rails, Next.js, and ImageMagick. As co-founder Harsh Jaiswal put it, it was 'literally xkcd #234, one obscure image library beneath a huge number of apps.' The economics are the alarming footnote: the whole two-month campaign across all those targets ran on three researchers and under $3,000 in AI tokens.

The reassuring part (mostly)

This was responsible disclosure, not a breach. Hacktron is a legitimate AI-security firm (a $2.9M pre-seed, DEF CON CTF pedigree); they reported the bugs, proved access with a deliberately harmless PR rather than stealing anything, and collected a $6,500 bounty. OpenAI's response was genuinely strong — a roughly 14-hour SSO fix is fast incident response. The bug-bounty system did exactly its job: the good guys found it first and got paid.

Two honest caveats keep this from being a pure feel-good story. The full scope is unconfirmed — how many employee accounts were reachable, and whether any customer data could have been touched, OpenAI hasn't said; its only public actions on record are the fix and the bounty. And the researchers went public precisely because the reassuring version has a shadow: the same capability that let white hats compress months into days is available to everyone else, too.

Our read: the exploit-writing floor just dropped

Strip away the company-on-company drama — an Anthropic model used against OpenAI, days after both labs spent the week publicly urging an AI slowdown — and what's left is a capability data point that's hard to spin. The scarce ingredient in offensive security has always been expert human time. A reliable memory-corruption exploit against modern defenses is specialist work measured in weeks. Hacktron showed a frontier model now does a real chunk of that work, and that the line between 'can't' and 'can' moved a full step between two releases.

It cuts both ways, permanently. The same Opus 5 that wrote this exploit powers Claude Code and the agentic coding tools we rank, and Anthropic ships it with security-refusal training and its own code-scanning products. Defenders get the identical leverage attackers do — faster patching, cheaper continuous pentests, more eyes on more code. Hacktron's entire business is that thesis: an AI that finds and proves vulnerabilities so they get fixed. The equilibrium isn't 'AI makes everyone insecure'; it's that both sides just got a cheap, massive capability boost, and the winners are whoever adapts their architecture fastest.

Bottom line: this is the clearest real-world evidence yet that frontier models crossed an offensive-security threshold — not in a benchmark, but on a live target, with a clean before-and-after between Opus 4.8 and Opus 5. The bug-bounty system contained it this time. The lasting takeaway is the researchers' own: the expertise bar for writing exploits just fell from months to days, and that's now true for everyone. Patch faster, connect fewer things, and assume your attackers have the same model you do.