Claude couldn’t hack OpenAI. Then Anthropic shipped Opus 5.
Three security researchers at Hacktron AI found a memory-corruption bug in a widely used image library. Finding it was the The post Claude couldn’t hack OpenAI. Then Anthropic shipped Opus 5. appeared first on The New Stack .
Three security researchers at Hacktron AI discovered a memory-corruption bug in a widely used image library. Turning this bug into a working exploit proved challenging, so they handed the task to Anthropic’s Claude Opus 4.8 on July 24. Claude managed to bypass the operating system's memory randomization protection only when it was disabled. Within a short period, Claude was able to execute a working exploit against a Mac on Anthropic's desk, followed by remote code execution against a test forum.
The vulnerability lay within Discourse, the community forum software used by OpenAI. Discourse's FastImage module failed to properly handle HEIC and HEIF image formats, resulting in the use of libheif, which had a known heap buffer overflow. Despite an upstream fix existing the previous year, the Debian package used by the forum did not receive a backport containing the patch, leaving the flaw exploitable.
Hacktron AI adapted their exploit for x86-64 and jemalloc configurations, and a malformed HEIC image triggered remote code execution. OpenAI later confirmed this vulnerability (CVE-2026-32882) rated 8.8 out of 10 on the CVSS severity scale. Hacktron then uncovered a flaw in OpenAI's single sign-on system, where sign-in tokens issued for the forum carried excessive permissions, granting full API access to the linked ChatGPT and Codex accounts.
One employee's Codex account was connected to OpenAI's GitHub environment, allowing access to private repositories. Using OpenAI's Codex account, the researchers created a harmless documentation change in OpenAI's private openai/openai monorepo and opened a pull request. The team then ran Claude in an autonomous agent loop, enabling it to achieve remote code execution and demonstrate it by reading /etc/hosts from inside a container.
The entire attack was completed within two months and cost less than $3,000 in model tokens. OpenAI rewarded Hacktron AI with a $6,500 bounty for the account-takeover flaw, and later narrowed the permissions on community sign-in tokens and revoked the affected tokens and sessions.
Written by urgent.news from The New Stack's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
