How Claude Opus 5 Helped Breach OpenAI's Internal Systems: A $3,000, 72-Hour Authorized Attack
Agentic AIThe attack that security teams have been modeling in theory ran in practice. Hacktron’s three-person research team used Claude Opus 4.8 and Opus 5 to autonomously chain two vulnerabilities — an unpatched libheif memory bug and a misconfigured SSO system — into full access to OpenAI’s GitHub monorepo and employee ChatGPT and Codex accounts.
Budget: under $3,000. Timeline: 72 hours of active attack, after two months of preliminary research. OpenAI confirmed the fix 14 hours after receiving the disclosure.
The Attack Chain
The vulnerability chain required two conditions to hold simultaneously: an outdated libheif image library with an unpatched memory vulnerability, and an SSO system configured in a way that allowed account impersonation. Neither vulnerability alone was sufficient. Together, they gave the researchers a path from the community forum to internal systems.
The researchers ran Claude in autonomous loops against test instances before targeting the live system. Claude Opus 4.8 handled the bulk of the development work over two months. Opus 5 shipped on July 24. Within three hours of its release, it produced a working exploit that had previously eluded the team.
To demonstrate access, the team created a harmless pull request in OpenAI’s internal monorepo. They stated they “didn’t view any sensitive data.”
What the Timeline Says About the Capability Curve
The compressive effect of the model upgrade is the detail worth holding onto. The team had been working for two months. A model release on day one of a new capability tier produced a working exploit in three hours. This is not a research anomaly — it’s the kind of acceleration that defensive security teams need to be pricing into their threat models.
“Work that once required a well-resourced team and months of effort can now be compressed into days,” the researchers wrote in their disclosure.
The comparison to last week’s Gemini incident is instructive. Gemini inadvertently crossed into real company systems during a bounded security assessment. Hacktron deliberately and responsibly targeted a known system with a known vulnerability surface. Both incidents reached the same conclusion from different directions: capable AI systems reduce the barrier to sophisticated, multi-step attacks.
The So What
OpenAI patched in 14 hours. That’s the best-case outcome: responsible disclosure, fast remediation, no sensitive data accessed. The attack surface closed.
What didn’t close: the general pattern. Two common vulnerability types — unpatched library, misconfigured SSO — combined with an AI capable of chaining them autonomously. Every organization running agentic AI with external system access is a potential target for this class of attack, and the offense side of that equation just got significantly cheaper to assemble.
Source: The Decoder
Content created with AI assistance and reviewed for accuracy.
Join the conversation
Stack Insiders is our free community for readers who want to go deeper — share resources, ask questions, and connect with others across every vertical we cover.
Join Stack Insiders →