Opus 4.8 couldn't write a working exploit, but Opus 5 did it in three hours
The chain it wrote reached OpenAI employees' ChatGPT accounts, and from there a pull request in the private openai/openai repo.
On July 25, 2026, three researchers at the security company Hacktron chained two bugs together and ended up inside several OpenAI employees' ChatGPT accounts. To prove it without reading any internal code, they got one employee's Codex to open a harmless pull request, number 1186742, in OpenAI's private monorepo.
From first look to repo access took under 72 hours. The model they were using changed in the middle of it.
- Break-in
- July 25, 2026
- Discovery to repo access
- less than 72 hours
- Proof
- pull request #1186742
- Bounty OpenAI paid
- $6,500
- Wider campaign cost
- less than $3,000 in tokens
- Researchers
- three
The model changed overnight
On July 23 they started reading Discourse's image-upload pipeline, which is what runs OpenAI's help forum. HEIC and HEIF files skipped the usual checks and went to ImageMagick, and that put the libheif parser in front of files an attacker picks. An Opus 4.8 session found that some security fixes had never been backported into the libheif package in Discourse's Docker image.
On July 24, Opus 4.8 wrote a working exploit with ASLR switched off. Several more sessions failed to make it work with ASLR on. That evening Anthropic released Claude Opus 5, Hacktron opened a fresh session, and three hours later it had a working exploit for a local Mac.
Opus 4.8 struggled across several sessions to produce a working exploit with ASLR enabled. Within hours of Opus 5's release, we gave it the same problem and it succeeded.
The capture-the-flag disguise
Here's the part I didn't expect. Opus refused to write an exploit aimed at a remote instance, so they proxied their own Discourse Cloud server through a domain that made it look like a capture-the-flag target. Then they left the model in an autonomous goal loop and went away.
At 10:00 a.m. they came back and the agent had remote code execution, which it demonstrated by reading /etc/hosts. The same exploit script worked on OpenAI's forum.
The second bug is the one that matters more. Hacktron says anyone logging into that forum could have had their ChatGPT and Codex accounts taken over, and that the flaw sits in OpenAI's identity infrastructure rather than in Discourse: any service using the OpenAI sign-in would have done the same job. Codex accounts connect to GitHub, Slack and email, which is how a forum bug reached a private repo.
What it cost
The Discourse and OpenAI work took a few days of agent time and a few hours of human time. The wider campaign it belongs to, which Hacktron calls HEIF Heist, ran two months across Slack, Meta, GitHub Enterprise and several web frameworks, cost under $3,000 in tokens, and adapting the exploit to each new company took a day or two.
Nobody spotted them, with one exception. They say only Shopify detected the activity, and that was after thousands of images had gone in and its image processors had crashed over and over.
AI is removing that protection by turning more of this scarce expertise into compute
Hacktron is careful about the autonomy claim. Skilled human guidance still mattered, they write, and what changed is the amount of work a small team can get through. They also report a second jump, from Opus 5 to GPT-5.6 Sol, on targets where they knew nothing about the system beyond it being vulnerable.
How it was closed
OpenAI confirmed a fix on its side about 14 hours after the report, and on September 1, 2026 it paid $6,500 and marked the report resolved. Its comment on the award says testing against the Discourse-hosted forum was explicitly excluded from the bug bounty program, and that the money is for the OpenAI-side finding.
Discourse got the report on a Saturday, replied on Sunday, had a fix by Monday and published its advisory on July 28, 2026. Debian's security update for Debian 13 came on August 8, 2026, and Hacktron says that as of September 14, 2026 the patched upstream release is libheif v1.23.4.