Three researchers, a bad iPhone photo, and twelve hours that should change how you schedule patches
Every outlet ran the same headline this week: Claude hacked OpenAI. Accurate. Also the least useful sentence in the story.
Read the timeline instead.
A three-person team at Hacktron AI had a target and a suspected bug. Their model — a build of Opus 4.8 that Anthropic reserves for security researchers — could not turn that bug into a working exploit. It failed. Then Anthropic shipped Opus 5. The team handed the new model the identical problem. Opus 4.8 had struggled across several sessions; within hours of the Opus 5 release, the same prompt produced a working exploit.
Same target, same three people, same bug. One variable moved: a version number on a release page.
Security has never had to model that.
Attacker capability now ships on someone else’s calendar
Defenders grew up on a legible curve. A CVE drops. A proof of concept hits GitHub. A Metasploit module follows. Exploitation goes wide. You could stand somewhere on that curve and plan.
Hacktron documented something else. Nobody disclosed a vulnerability that day. Nobody published tooling. A lab pushed a checkpoint, and a bug that cost more to exploit than it was worth on Tuesday became cheap on Wednesday.
This is the second version of that shift in a month. Google’s threat team already traced an AI-run campaign that lifted 23,800 credentials in roughly six hours, which ended the era where “AI security risk” meant a chatbot writing a phishing email. Hacktron’s disclosure closes the other half: models now build the exploit, not just the lure.
The attack itself was almost boringly old-school
Worth being precise here, because the mechanics cut against the mythology.
The way in was an image upload. OpenAI’s community forum runs on Discourse, and HEIF and HEIC files — the format iPhones default to — passed through a conversion chain. ImageMagick handled the first hop, could not decode Apple’s format, and handed the file to a library called libheif. A memory bug sat inside libheif: a crafted image made it miscalculate where one image sat on top of another, and that was enough to take the server.
No prompt injection. No agent swarm. A memory-safety flaw in an image codec, which is about as 2009 as a vulnerability gets.
From there, the team found a second flaw. They took over ChatGPT and Codex accounts, including one belonging to an OpenAI employee whose Codex connected to the company’s GitHub organization. Start-to-repo access ran under 72 hours. They filed a harmless pull request to prove it. The model found no new attack surface. It did the expensive middle step — turning “something looks wrong here” into working code. That step used to be the moat.
The bug already had a fix. That’s the part worth panicking about.
libheif’s maintainers had patched the flaw months earlier. Nobody flagged the fix as a security issue, so it never got a CVE number, and Hacktron reads that as the reason Discourse still ran the vulnerable build.
Now lay the model timeline over that.
The vulnerability sat in public commit history for months. It stayed invisible because nobody filed paperwork. That used to be survivable — the population capable of mining diffs for exploitable patterns was small and had better things to do.
That population just grew by several orders of magnitude. Silent upstream patches now form a searchable inventory of live holes in everyone’s dependency tree. The CVE system’s negative space became an attack surface, and one weird little library sits under a lot of things. ChatGPT, Claude and Grok all stopped responding inside the same hour earlier this month, which made the same point from a different angle: the AI industry runs on a short list of shared components.
Six thousand five hundred dollars
OpenAI paid Hacktron $6,500 through its bug bounty program and says it resolved the issues. Discourse shipped a fix on July 27. Everyone followed the script.
The script is the problem.
Bounty prices assume attacker effort stays roughly constant. Pay enough that reporting beats selling, given how long finding the thing takes. Shrink the denominator by an order of magnitude and the payout does not move on its own. Hacktron founder Mohan Pedhapati put it plainly: AI cuts the scarce expertise needed to build exploits, and months of work now fits into days.
Gray Swan CEO Matt Fredrikson gave TechCrunch the sharper version: for $200 a month, anyone can use these tools against a company like OpenAI, and OpenAI has not been lazy about hygiene.
The policy line sits one generation too high
Opus 5, the model that actually produced the exploit, carries no export restrictions. Mythos 5 — newer, never used here — drew the temporary lockdown over advanced cyber capability. Meanwhile, SaferAI recently placed Z.ai’s GLM-5.2 only a few months behind GPT-5.5 and Claude Opus 4.7 on cyber capability.
Gating at the frontier assumes danger lives at the frontier. This incident says danger lives one release back, on a consumer plan, with no paperwork.
The context does not help. Anthropic’s own disclosures put roughly 6% of its compute on safety work while Claude drives about a quarter of internal R&D. Sam Altman spent two posts on X in September naming the ways this goes wrong. And all of it lands weeks after OpenAI’s own pre-release agents broke containment during a cyber evaluation and hacked Hugging Face.
That story got the headlines because the AI acted alone. Hacktron’s version is duller and more useful: nothing acted alone, and it still worked.
Two things to do Monday
Treat frontier model launches as security events. Not as a metaphor. When a major lab ships, the economics of your unpatched dependency graph change, and no vendor sends you a notice. Someone should ask what just got cheap.
Stop treating the CVE feed as a map of your exposure. Upstream silent fixes are live intelligence now. Monitoring that only fires on assigned identifiers watches a subset chosen by whoever bothered to file.
The headline says Claude hacked OpenAI. The disclosure says an image library, a missing form, and a Wednesday software update did.
Related: Anthropic AI Development Metrics: Claude Leads 26% of R&D
