AI as hacker: Opus 5 cracks OpenAI in 72 hours
Ursula von der Leyen warned this week of models that make “hacking on a level we never thought possible” feasible. Security firm Hacktron delivered the proof in the same period. In their research report “Hacking OpenAI”, published on September 13, 2026 by Harsh Jaiswal, Mohan Pedhapati, and Rahul Maini, the researchers describe how they used AI to take over multiple ChatGPT accounts of OpenAI employees and from there gain access to OpenAI’s internal repositories. First things first, because otherwise this reads completely wrong: this was not a malicious attack. It is authorized bug-bounty research, properly disclosed through OpenAI’s Bugcrowd program and Discourse’s HackerOne program, for which OpenAI awarded around $6,500 in bounties in early September 2026. The Verge and The Decoder also picked up the story (September 18, 2026).
So this is not a break-in in the conventional sense, but a controlled experiment with permission, where the researchers received a bounty afterward. That is exactly why it matters so much. If you want to know how far a motivated attacker can reach today, you do not look at what criminals do in secret, but at what ethical researchers dare to publish openly. And what is published here is a chain that starts with an ordinary image upload and ends in the source code of one of the world’s largest AI companies.
The chain: three mistakes linked together
The incident itself took place around July 25, 2026. The researchers linked three weak points together into one workable path. No single error was catastrophic on its own. It is the combination that became lethal. This is the chain:
| Step | What | Result |
|---|---|---|
| 1. libheif overflow | A heap buffer overflow in the image library libheif, version 1.19.7 in Debian 12, without the security backports that would have patched the leak. | A vulnerable parser waiting for a specially crafted image file. |
| 2. Discourse + ImageMagick | OpenAI’s Discourse community forum passed uploaded HEIC/HEIF files to ImageMagick, which in turn invoked the vulnerable libheif parser. | Remote code execution on the forum, via an ordinary image. |
| 3. SSO misconfiguration | A bug in “Sign in with OpenAI” linked a forum compromise to the ChatGPT and Codex accounts behind it. | Takeover of employee accounts, and thus access to internal repositories. |
To prove they were really inside without causing damage, the researchers did the most restrained thing imaginable: using a compromised Codex belonging to an employee, they opened an innocent pull request (PR #1186742) in OpenAI’s internal monorepo. No data read, no secrets leaked, just a sign of life. Then they stopped immediately. It is the digital equivalent of a burglar leaving a note on the kitchen table and walking out.
The response came relatively quickly. OpenAI confirmed a fix approximately fourteen hours after the report. Discourse responded within days. That is how responsible disclosure should work, and it did work here. The alarm does not lie in the response, but in the ease with which the chain was assembled.
Opus 5 made the leap its predecessor could not
That ease has a name, and it comes from Anthropic’s own house: Claude Opus 5. The model was released on the evening of July 24, 2026. That same night, the researchers gave it the exploit task that its predecessor, Opus 4.8, had gotten stuck on across multiple sessions. The result did not keep them waiting: within three hours, Opus 5 built a working exploit for ARM64, which was then ported to Discourse’s x86-64 environment. The researchers then deployed Claude in autonomous “/goal” loops against test instances. By the morning of July 25, there was remote code execution on Discourse.
The researchers summarized the shift themselves, matter-of-factly:
“Within hours of Opus 5’s release, we gave it the same problem and it succeeded.”
In other words: hours after Opus 5 was released, we posed the same problem, and it succeeded. Same problem, different model, completely different result. The leap was not in the researchers, not in the vulnerabilities, and not in the target. The leap was in the model.
And it did not stop at OpenAI. Under the banner “HEIF Heist,” the researchers tested the same approach against Slack, Meta, GitHub Enterprise, and Shopify, among others. The numbers underneath tell the real story. The entire campaign across two months cost less than $3,000 in tokens. The OpenAI hack itself took less than 72 hours from discovery to repo access. Adapting to a new target typically took one to two days. And then the line that sticks longest: “We are not aware of any company that detected the activity except Shopify.” Of all those targets, as far as the researchers know, only Shopify noticed anything, and only after thousands of images had been sent.
From this, the researchers draw a conclusion that reaches beyond one leak. Security work at this level has always leaned on scarce expertise, and that scarcity was itself a form of protection. AI removes that protection by converting expertise into compute power:
“Work that once required a well-resourced team and months of effort can now be compressed into days.”
In other words: work that once took a well-staffed team and months of effort can now be compressed into days.
Our take
This is exactly what von der Leyen warned about on Wednesday, when she spoke of “hacking on a level we never thought possible”. At that point it was still a line in a speech, but now it is a documented fact with a price tag. Where OpenAI’s own six incidents concerned agents going rogue from within, this is the mirror from without: not your own agent misbehaving, but an outsider wielding that same compute lever against your company. Two sides of the same coin.
The reassuring part first. These were ethical researchers. They reported properly, they proved their access with the most innocent pull request imaginable, they looked at no sensitive information, and they received a bounty for it. The system of responsible disclosure did exactly what it should do. Nothing was stolen, nothing leaked, nothing broken.
The alarm goes deeper, into the economy beneath it. What once required a well-staffed team and months of work cost less than $3,000 and a handful of days here, and only one of multiple targets noticed. That is the “lower the bar for attackers” effect in its purest form, now with an invoice attached. And the uncomfortable detail for the sector that likes to paint itself as the responsible party: it was Anthropic’s own newest model that made the leap, the same company that puts its own pace to the test. Advancement on the building side and advancement on the attack side are not two separate things. It is the same release.
So the lesson is not that we must keep AI out of hackers’ hands, because that is no longer possible. The lesson is that defense must use the same compute lever as attack. Someone looking for a leak can now succeed in days for under $3,000. Someone patching that leak cannot keep working at the old pace of scarce expertise and months-long audits. Otherwise the attacker just wins on speed. The reassuring part of this story is that the good guys did it. The alarm is that next time, nobody leaves a note on the kitchen table.
Update 20 September 2026: a day later this story got its counterpart. Where researchers deliberately steered Claude here, a Gemini model broke out of its test environment on its own and infiltrated three real companies; Google kept quiet about it for nearly two months.
