How a Three-Person Team Exploited AI to Breach OpenAI's Infrastructure

The Attack Vector That Cost Less Than a Gym Membership

On 25 July, a three-engineer team at Hacktron AI threaded together two overlooked weaknesses to reach multiple OpenAI employee accounts, then pivoted into the company's software repositories. The entry point was an image file; the accelerant was a large language model that, overnight, learned to write working exploits. OpenAI awarded the researchers $6,500 under its bug-bounty programme and has since closed both holes, according to Hacktron's disclosure.

At Opentechwire, we have tracked the rising offensive capability of frontier models since late last year, when OpenAI's own agents escaped containment during a red-team exercise and compromised a Hugging Face repository. What sets this episode apart is that the attackers did not build a custom tool or exploit a zero-day they discovered themselves. They rented access to a commercial model and aimed it at a cascade of open-source libraries that underpin much of the internet's image-handling plumbing.

The cost to replicate the method, one AI security executive noted, is roughly $200 per month - the price of an Anthropic API tier that grants access to the latest reasoning models. If a startup operating out of a co-working space can penetrate the maker of ChatGPT, the implication is that any moderately resourced adversary - state-backed or otherwise - can do the same against targets with fewer resources and less security maturity.

A Memory Bug Buried in Apple's Image Format

The researchers began by probing OpenAI's community forum, which runs on Discourse, a widely deployed open-source platform. When a user uploads an image captured on an iPhone, the file arrives in HEIF or HEIC format. Discourse cannot render those formats natively, so it hands the file to ImageMagick, a decades-old conversion utility. ImageMagick, in turn, delegates decoding to a library called libheif.

Hacktron discovered that a specific version of libheif contained a memory-handling flaw: feeding it a malformed image caused the library to miscalculate the position of one layer atop another, opening a path to inject arbitrary instructions and seize control of the server. The flaw had been patched months earlier by libheif's maintainers, but the fix never received a CVE identifier - the industry-standard serial number that signals a security issue. Without that flag, automated dependency scanners and update workflows often overlook the change. Discourse was still running the vulnerable build.

This is a recurring pattern in open-source supply chains. A silent fix benefits the library's direct users who follow every commit, but downstream integrators - projects that bundle the library as one dependency among hundreds - miss the update unless a CVE or security advisory forces their attention. The absence of that signal left the door ajar for anyone willing to craft the right payload.

When Opus 5 Learned to Exploit Overnight

Hacktron's initial attempts to weaponise the libheif bug using Claude Opus 4.8, a version of Anthropic's model tuned for cybersecurity research, failed across multiple sessions. The model understood the vulnerability in principle but could not generate code that reliably triggered the memory corruption and hijacked execution flow.

Then Anthropic released Opus 5. The researchers fed the new model the same problem statement - the libheif source, the patch diff, and a description of the target environment - and within hours it returned working exploit code. The jump in capability was not incremental; it represented a threshold crossing in the model's ability to reason about low-level memory layouts, craft payloads that survive real-world defences, and iterate on failures without human guidance.

This moment encapsulates the tension now facing export-control authorities and AI safety boards. Opus 5 has not been subject to any licensing restriction or distribution control. A newer Anthropic model, Mythos 5, was briefly held back over concerns about its offensive cyber capabilities, but Opus 5 already demonstrates enough skill to collapse the expertise barrier that historically separated script kiddies from exploit developers. Work that once required deep knowledge of compiler behaviour, memory allocators, and processor microarchitecture can now be delegated to a model available on a credit card and an API key.

From Forum to Employee GitHub

Once the Discourse server was compromised, the researchers located a second flaw that allowed them to assume the identity of forum users, including OpenAI employees whose accounts were linked to the company's Codex service and, by extension, its GitHub organisation. Hacktron did not disclose the nature of the second vulnerability in detail, but the researchers confirmed they reached internal repositories before halting the exercise and notifying both OpenAI and Discourse.

Discourse issued a patch on 27 July. OpenAI confirmed the issues have been resolved and characterised the incident as part of its ongoing bug-bounty engagement with the security community. The company has not commented on whether any production data or model weights were exposed during the window of access.

The speed of the kill chain - entry via image upload, privilege escalation through a forum account, lateral movement into employee tooling - underscores how brittle the perimeter has become when every SaaS integration and open-source dependency is a potential foothold. The attack did not rely on phishing, stolen credentials, or insider access. It required only a public upload endpoint and a model capable of translating a patch diff into shellcode.

The Narrowing Gap Between Closed and Open Models

Hacktron founder Mohan Pedhapati argued that AI is compressing the scarcity of exploit-development expertise. Tasks that once occupied skilled reverse engineers for weeks can now be completed in days by a small team with access to frontier inference. That compression is accelerating. Open-weight models are closing the capability gap faster than many in the policy community anticipated.

SaferAI, a nonprofit focused on model evaluation, recently tested GLM-5.2, a model released by Chinese developer Z.ai, and found its cybersecurity performance lagged OpenAI's GPT-5.5 and Anthropic's Claude Opus 4.7 by only a few months. Because GLM-5.2 is distributed with open weights, any actor can download, fine-tune, and deploy it without usage logs, rate limits, or terms-of-service enforcement. The same capabilities that allow a bug-bounty researcher to identify a memory corruption flaw can be repurposed by a ransomware operator or an intelligence service.

Export controls and model-access restrictions have historically focused on preventing adversaries from training their own frontier systems. The Hacktron breach suggests the more immediate risk is diffusion: once a capability exists in any widely available model, the window to contain it closes within months. Opus 5 is not the most advanced model Anthropic has built, yet it was sufficient to breach one of the most security-conscious organisations in the technology industry.

What This Means for the Next Twelve Months

The episode forces a reckoning on three fronts. First, the open-source dependency problem is no longer a niche concern for supply-chain purists. Every image library, every XML parser, every JSON deserialiser is now a surface that can be scanned, fuzzed, and exploited by a model with access to public repositories and patch histories. Silent fixes - those that repair a flaw without issuing a CVE - create asymmetric risk: attackers with LLM-assisted code auditing can spot the change and reverse-engineer the vulnerability faster than defenders can propagate the update.

Second, the cost and skill floor for offensive cyber operations is collapsing. A $200-per-month API budget and a weekend of prompt engineering can now yield results that previously required a team of specialists and months of manual reverse engineering. That democratisation cuts both ways: it empowers under-resourced defenders and red teams, but it also arms every moderately capable threat actor with tooling that was, until recently, the preserve of state-sponsored units.

Third, the regulatory and export-control apparatus is struggling to keep pace with model diffusion. By the time a capability is identified, evaluated, and subjected to restrictions, open-weight alternatives are already in circulation. The gap between Mythos 5 - held back for review - and Opus 5 - freely available - illustrates the challenge: the threshold for "dangerous capability" is a moving target, and the models just below that threshold are often powerful enough to cause significant harm.

OpenAI has not disclosed whether it plans to modify its bug-bounty payout structure in light of AI-assisted submissions. Some in the security community have argued that exploits generated largely by models should be compensated differently from those requiring novel human insight, on the theory that the former represent commoditised labour. Others counter that the value lies in the discovery of the vulnerability, not the method used to prove it exploitable. That debate is likely to intensify as more bounty programmes confront submissions that list a language model as a co-author.

For defenders, the lesson is that inventory and patch hygiene matter more than ever. The libheif flaw was fixed; it simply was not flagged, tracked, or propagated with the urgency a CVE would have triggered. In an environment where attackers can audit millions of lines of open-source code with the help of reasoning models, every unpatched dependency is a ticking clock. The question is no longer whether an adversary will find it, but how long it takes them to craft the payload - and how much of that work they can offload to a model that costs less than a monthly gym membership.