Here's a story that sounds like a movie plot but is completely real: a small security startup used one AI lab's model to hack a rival AI lab, got paid by the victim for their trouble, and published the whole thing this week. Claude Opus 5 hacked OpenAI — with human researchers steering, but the AI doing a serious chunk of the exploit work. The Wall Street Journal reported it first, and Forbes, VentureBeat and Business Insider all followed this morning.
01.What actually happened?
On July 25, 2026, researchers at Hacktron AI — a San Francisco-based AI cybersecurity startup — chained two vulnerabilities to compromise ChatGPT and Codex accounts, including one belonging to an OpenAI employee. That employee's Codex was connected to OpenAI's GitHub organization, which meant a path into the company's internal code. To prove the access was real without actually reading anything sensitive, the researchers instructed Codex to open a harmless pull request in OpenAI's internal monorepo. Then they stopped, reported everything, and OpenAI fixed the SSO flaw within roughly 14 hours of the submission.
The team disclosed the operation publicly this week, and OpenAI paid them a $6,500 bounty — around ₹5.4 lakh — through its Bugcrowd program.
02.How the Claude Opus 5 attack worked
The entry point is almost boring: an image upload. OpenAI's community forum runs on Discourse, and HEIC/HEIF image files there get passed to ImageMagick for conversion, which exposes the underlying libheif parser. That parser had a heap buffer overflow. Upload one malicious image and you could get remote code execution on the forum's server.
The second bug is the one that should keep security teams up at night. OpenAI's single sign-on had a flaw that turned control of the forum into access to the ChatGPT and Codex accounts of people who had signed in through it — including employees. Forum compromise plus SSO weakness equals account takeover, and those accounts were connected to GitHub, Slack, Outlook, Gmail and more.
Where does Claude come in? The Hacktron team had access to a special version of Claude through Anthropic's Cyber Verification Program, which relaxes certain cyber restrictions for qualified security practitioners. Claude Opus 4.8 found the libheif vulnerability and built a partial exploit but, in the researchers' words, "struggled across several sessions" to make it reliable. Then Anthropic released Opus 5 that very evening. The new model produced a working ARM64 exploit within about three hours, then ported it to the x86-64 environment the forum actually used. From first probe to confirmed access: less than 72 hours.
03.The quote that should worry everyone
In their conclusion, the researchers wrote something I haven't been able to stop thinking about: "Software has long benefited from a kind of security through complexity... AI is removing that protection by turning more of this scarce expertise into compute. Work that once required a well-resourced team and months of effort can now be compressed into days... Security assumptions must catch up with attacker capabilities."
Honestly, what surprised me most wasn't that AI could write an exploit. It was the economics. The OpenAI hack took "a few days for an agent, and just a few hours of human time." The broader HEIF Heist project — which found similar issues across Slack, Zoom, Meta, GitHub Enterprise and Next.js — took two months, three researchers, and less than $3,000 (roughly ₹2.5 lakh) in tokens. That's less than what many Indian companies spend on a single training workshop.
04.Why this matters for India
For anyone building a career in cybersecurity in India, this is a loud signal. Bug bounties are real money — that ₹5.4 lakh payout came from one properly reported chain — and AI agents are rapidly becoming the standard toolkit for serious vulnerability research. The skill that pays now is knowing how to direct these models: scoping targets, verifying findings, and writing reports that companies act on. The pure memorization part of security work is getting automated; the judgment part is not.
It also matters for every Indian business running forums, upload features or SSO. If OpenAI can be breached through an image parser and a login flaw, so can a fintech app in Bengaluru or a D2C store in Surat. Patch your dependencies, sandbox your image processing, and limit what a compromised account can reach.
Timing-wise, this lands in the same week OpenAI disclosed six misalignment incidents and lab CEOs are openly calling for a slowdown — we covered that safety push in detail earlier, and Anthropic's own trusted-access cyber model releases are part of the same story. If you're trying to understand how AI agents actually behave when let loose on real systems — including where guardrails hold and where they don't — the safety chapter in our GPT-6 Astra — Zero to Hero Guide walks through it in plain language.
Related read
We went a level deeper the next day in Claude Opus 5 Hacked OpenAI: The Real AI Security Story — what the model actually did, step by step, and what it means for agent security.
Key Takeaways
- Claude Opus 5 helped turn a known libheif flaw plus an OpenAI SSO bug into internal code access in under 72 hours
- OpenAI paid a $6,500 (₹5.4 lakh) bounty and fixed the SSO issue within ~14 hours of the report
- Discourse independently confirmed the image-upload RCE and rated it CVSS 8.8
- The full HEIF Heist research cost under $3,000 in tokens — advanced exploitation is getting dramatically cheaper
- AI security skills, especially directing agents for offensive and defensive research, are becoming a serious career path in India
Frequently Asked Questions
What is the HEIF Heist?
HEIF Heist is the name for the operation in which San Francisco security startup Hacktron AI used Claude Opus 5 to breach OpenAI. The researchers chained two vulnerabilities — a libheif image-parsing flaw in OpenAI's community forum and an OpenAI single sign-on weakness — to compromise ChatGPT and Codex accounts, including one belonging to an OpenAI employee, in under 72 hours with just a few hours of human time.
How much did the hack cost and what bounty was paid?
The researchers say the whole project cost less than $3,000 — roughly ₹2.5 lakh — in tokens. OpenAI paid them a $6,500 bounty (about ₹5.4 lakh) through its Bugcrowd program and fixed the SSO flaw within roughly 14 hours of the report.
Did the researchers actually steal OpenAI's code?
No. To prove the access was real without reading anything sensitive, they instructed the compromised Codex instance to open a harmless pull request in OpenAI's internal monorepo — then stopped, reported everything, and went public only after the fix.
What This Means for You
If you're a student or professional wondering which AI skill to bet on, put AI security near the top of the list. Hacktron's story shows the demand is real, the payouts are real, and the barrier is no longer a PhD — it's knowing how to run these agent workflows properly, verify what they produce, and stay on the right side of responsible disclosure. That's a learnable skill. Our GPT-6 Astra — Zero to Hero Guide covers the agent and safety fundamentals you'd build on, and the practical next step is simple: start with our guide, then try a beginner-friendly bug bounty platform and see where the frontier actually sits.