Hackers breach OpenAI in 72 hours

Hacktron security researchers compromised an OpenAI employee's ChatGPT account and accessed internal company code on Github while participating in OpenAI's bug bounty program.

They used Anthropic's Claude Opus 5

The researchers used a special version of Anthropic's Claude made available to qualified cybersecurity practitioners to pull off the attack.

Claude Opus 4.8 struggled repeatedly

Hacktron first tried Claude Opus four point eight to create the breach but faced multiple setbacks as the model struggled across several sessions to produce a working exploit.

The flaw: image file processing

The breach exploited a flaw in the dot heic, dot heif and dot avif image file format decoder and encoder. This libheif vulnerability also affects Slack, Meta, Github Enterprise and Ruby on Rails.

How the attack chain worked

OpenAI's community forum uses Discourse, which uses FastImage for image checks. FastImage does not support dot heif files, so they go to ImageMagick for conversion instead.

Opus 5 changed everything

On the day Anthropic released Claude Opus 5, Hacktron created a working remote code execution exploit by setting an AI agent in a loop to exploit a local Discourse Cloud instance.

From forum to Github access

The successful Discourse exploit was used against OpenAI's community forums to hijack an employee's ChatGPT account. That employee had connected their ChatGPT Codex to the company's Github, giving full repo access.

Hours, not weeks or months

Opus 5 took just a few hours to develop a working exploit. The full timeline from initial discovery to OpenAI repo access took less than seventy two hours.

Wider research cost under three thousand dollars

Hacktron's research into the libheif exploit against Slack, Zoom and Meta took two months, cost less than three thousand dollars in tokens total and was conducted by three researchers.

“The AI started almost blind and adapted the exploit for each company within one or two days. We are not aware of any company that detected the activity except Shopify, even after thousands of images were sent and their image processors repeatedly crashed.”

AI agents compress attack timelines

Spencer Starkey, Executive VP EMEA at SonicWall, warns that AI agents running in continuous loops shift exploit timelines from weeks or months to mere hours for attackers.

Security platforms built by AI lack accountability

Starkey questions whether security platforms built entirely by AI with no human track record can provide accountability and institutional knowledge when breaches occur at two am.

“Do you actually want your security platform to have been built by AI, with no human track record behind it?”