What happened
Security researchers from Hacktron AI used Anthropic's Claude Opus 5 to hack an OpenAI employee's ChatGPT account and reach the company's internal GitHub environment. The researchers discovered a vulnerability in OpenAI's single sign-on implementation that allowed them to turn control of the forum environment into access to ChatGPT and Codex accounts belonging to users who had authenticated through the service. They then used the compromised employee account's access to Codex to create a harmless pull request in OpenAI's internal monorepo, demonstrating that the account compromise could extend beyond ChatGPT itself into connected developer infrastructure.
The researchers used Anthropic's Claude Opus 5 to investigate the vulnerable libheif package and develop an exploit.
They initially used Claude Opus 4.8 but switched to Opus 5, which produced a working ARM64 exploit within hours.
The researchers then adapted the exploit to the x86-64 and jemalloc environment used by Discourse.
The full path from discovery to access to OpenAI's repository environment took less than 72 hours.
The researchers reported the findings through OpenAI's Bugcrowd program on July 25 and received a payout of $6,500.
Source details: venturebeat.com ↗
Why it matters
This incident highlights the risks associated with AI agents connected to business systems and the importance of isolating untrusted file-processing pipelines, keeping low-level dependencies aggressively patched, constraining federated identity trust, and treating AI-agent credentials with the same scrutiny as privileged human accounts.
The incident highlights the risks associated with AI agents connected to business systems.
It demonstrates how AI coding agents are changing the economics of sophisticated vulnerability exploitation.
The researchers argue that frontier coding agents can increasingly perform much of the incremental exploit-development work under human direction.
The broader libheif ecosystem reinforces the maintenance problem, with dozens of security advisories published during 2026.
The incident emphasizes the need for organizations to take a more proactive approach to security, including isolating untrusted file-processing pipelines, keeping low-level dependencies aggressively patched, constraining federated identity trust, and treating AI-agent credentials with the same scrutiny as privileged human accounts.
Interactive Mechanism: How It Actually Works
Explore the underlying technology behind this development interactively.
crm_get_transaction(id='4092').What is the most accurate way to describe what AI Agents can do today?
What to watch next
The incident demonstrates how AI coding agents are changing the economics of sophisticated vulnerability exploitation and the need for organizations to take a more proactive approach to security.
The incident demonstrates the potential impact of AI agents on security.
It highlights the need for organizations to take a more proactive approach to security.
The researchers argue that AI coding agents are changing the economics of sophisticated vulnerability exploitation.
The incident emphasizes the importance of isolating untrusted file-processing pipelines and keeping low-level dependencies aggressively patched.
The researchers note that the same class of models is making technically difficult exploit development faster and less expensive.