Hacktron Researchers Breach OpenAI Using Anthropic's Claude Opus 5 in Under 72 Hours

Cybersecurity startup Hacktron AI compromised OpenAI employee accounts and accessed the company's private GitHub monorepo within 72 hours in July. The three-person team — Harsh Jaiswal, Mohan Pedhapati, and Rahul Maini — conducted the test under OpenAI's bug bounty program.

The attack chain began with a heap buffer overflow in the libheif image-decoding library used by the Discourse forum at community.openai.com. Researchers uploaded a malicious HEIC file that achieved remote code execution on the forum server.

“The release of Opus 5 changed everything.”

Anthropic's Claude Opus 5 proved critical after Opus 4.8 failed to produce a reliable exploit against standard ASLR protections. Opus 5 generated working exploit code in a single session, accelerating the timeline from weeks to hours.

The forum compromise allowed researchers to hijack an employee's ChatGPT account linked to Codex, which had access to OpenAI's GitHub organization. They created a harmless pull request in the private openai/openai repository to prove access without viewing proprietary code.

OpenAI patched the identity infrastructure flaw roughly 14 hours after notification and paid a $6,500 bounty. The libheif vulnerability had been fixed upstream a year earlier but lacked a CVE designation, leaving Debian-based Discourse Docker images vulnerable.