Three Hours, Not Three Months
On July 23, three security researchers at Hacktron were staring at a heap buffer overflow in libheif, the library that decodes HEIC and HEIF photo files. They had a theory. OpenAI's own community forum, community.openai.com, ran on Discourse. Discourse's upload pipeline handed unrecognized image formats straight to ImageMagick, which depended on the same vulnerable libheif. Claude Opus 4.8 spent several sessions trying to turn the theory into a working exploit and could not get past address space layout randomization. The researchers shelved it.
Then, on the evening of July 24, Anthropic released Claude Opus 5. The team gave the new model the identical problem. Within three hours it had a working ARM64 exploit for a local Mac, then ported it to Discourse's production x86-64 and jemalloc environment on its own. By 06:00 UTC on July 25, the exploit worked against a local target. By 10:00 UTC, it worked against OpenAI's live forum.
The Bug Nobody Had to Patch
The libheif flaw was not a discovery. It had already been fixed upstream, quietly, without a CVE number assigned to it. No CVE meant no alert reached Debian's security team, so Debian 12, the base image Discourse ran on, never pulled the fix. Discourse inherited it through ImageMagick. OpenAI's forum inherited it through Discourse. Three organizations, three separate decisions not to act, none of them wrong on their own.
The forum breach alone would have been contained. What turned it into an OpenAI incident was a single sign-on link between the forum and employee ChatGPT and Codex accounts. Compromising a forum account handed the researchers a session that carried into Codex. Codex was wired to GitHub. GitHub held the openai/openai monorepo. Nine components, nine separate teams, one continuous path from an unpatched photo library to source code.
How Fast the Chain Actually Closed
Hacktron published its own timeline down to the minute. Laid out end to end, the gap between a model that could not finish the job and a model that walked straight through OpenAI's identity boundary was one product release.
| Time (UTC) | Event | Actor |
|---|---|---|
| Jul 23, 05:00-06:00 | libheif overflow identified; Opus 4.8 fails to build a reliable exploit | Human + Opus 4.8 |
| Jul 24, evening | Claude Opus 5 released; given the same target | Anthropic |
| Jul 25, 06:00 | Working ARM64 exploit confirmed on a local Mac | Opus 5 |
| Jul 25, 10:00 | Remote code execution reached on Discourse Cloud, /etc/hosts read back | Opus 5, human-directed |
| Jul 25, 13:30-15:30 | Employee ChatGPT and Codex account reached; access demonstrated, testing stopped | Human researchers |
| Jul 25, 22:49 | OpenAI confirms a fix is deployed | OpenAI |
| Sep 1 | OpenAI pays a 6,500 dollar bounty for the SSO finding only | OpenAI |
The three-hour exploit build is the headline. The part worth sitting with is the 22 hours and 49 minutes between the researchers reaching an employee account and OpenAI confirming the fix. That is the real response time the chain was tested against. It held.
Why It Matters for Every EU Operator, Not Just AI Labs
Hacktron's own conclusion is blunt: security has long leaned on complexity as a moat, the assumption that exploit development needs a well-resourced team and months of runway. That moat is what Opus 5 removed on this bug. The researchers wrote that work which once needed scarce specialized labor can now be compressed into compute. They added that the jump from Opus 5 to the next generation of models was already visible in their testing.
For a company under NIS2, that compression lands on the clock, not just the budget. Essential and important entities must flag a significant incident within 24 hours of becoming aware of it and file a full report within 72 hours. Hacktron's own chain, from a working exploit to a compromised internal repository, closed inside that same 72-hour window. The notification clock and the attacker's clock are no longer running at different speeds. A detection process built around days, not hours, is now built for the wrong adversary.
The Bottom Line
Nobody in this story did anything reckless. OpenAI ran a bug bounty and paid out inside days. Hacktron disclosed responsibly and stopped the moment access was proven. Discourse shipped a fix within 48 hours of the report. The system worked exactly as designed. An AI model still reached a frontier lab's source code from a photo upload bug that had already been fixed somewhere else on the internet.
OpenAI's own bounty terms excluded testing against Discourse itself, so the 6,500 dollar payout covered only the identity-boundary flaw, not the exploit that got the researchers in the door. That gap between what a bounty program covers and what an attacker actually needs is worth an audit on its own, model-assisted or not.
Read next: Your NIS2 Threat Model Just Assumed the Wrong Attacker | The Best AI Hacking Tools Are Now Invitation-Only
