On September 17, 2026, a research report from security startup Hacktron AI publicly disclosed that three researchers had used a vulnerability chain in late July of that year to successfully breach OpenAI's internal systems, obtain access to employee ChatGPT accounts, further read files in the private code repository Monorepo, and even submit a pull request proving access. The entire operation took less than 72 hours and consumed less than $3,000 in AI compute costs. OpenAI completed remediation the same day it was discovered and paid the team a $6,500 bug bounty.
Vulnerability Chain: From an Image to the Internal Code Repository
The attack path began with a seemingly insignificant image decoding library. Hacktron researchers found that the Discourse platform used by OpenAI's community forum called ImageMagick when processing HEIF/HEIC images, and ImageMagick depended on the libheif library, which had a heap buffer overflow vulnerability (CVSS score 8.8). By uploading specially crafted HEIF image files, the researchers achieved remote code execution on the forum server.
This was a relatively isolated vulnerability, but a second issue turned it into a tunnel into deeper systems: OpenAI's single sign-on system had a configuration flaw, and the authentication tokens for community forum users could be reused across multiple OpenAI services without sufficient isolation. Starting from the public community forum server, the researchers crossed the identity authentication boundary, logged into OpenAI employee ChatGPT and Codex accounts, and ultimately used the Codex account to connect to OpenAI's private code repository on GitHub.
According to The Wall Street Journal, this repository, named "Monorepo," contains important internal code related to the company's algorithms and software systems that can help models run faster and more efficiently, but it is not believed to contain model weights. After confirming access, the research team submitted pull request PR#1186742, adding the team's identifier and links to the researchers' social media accounts as proof of read-write access, but did not deeply inspect sensitive source code or initiate downloads. Hacktron CTO Mohan Peddapati's own words were blunt: "The scope we could theoretically access was enormous."
The Role of Claude Opus 5: The Failed 4.8 and the Successful 5
The most instructive part of this incident is the comparison between Anthropic's old and new generations of models. The researchers first tried to use Claude Opus 4.8 to develop exploit code, but failed after multiple sessions. On July 24, the same day Anthropic released Claude Opus 5, the team tried again—Opus 5 generated a working ARM64 exploit within 3 hours, and then autonomously ported it to an x86-64 architecture and jemalloc memory allocator environment.
According to VentureBeat, the researchers used a special version of Claude that Anthropic provides specifically to qualified cybersecurity professionals, not a public consumer product. But the key point is this: the two generations of models showed a jump from "0 to 1" in success rate on the same task, not a linear improvement from "60 points to 80 points." Opus 4.8 failed repeatedly, while Opus 5 succeeded the same day—this shows that AI-assisted exploitation capabilities are improving at a nonlinear rate, and such leaps may emerge suddenly with each major model release rather than being smoothly foreseen.
This detail also overturns a common defensive argument: for certain types of highly difficult attack tasks, AI can only serve as "assistance" and "efficiency improvement," while the actual attack still requires top experts. This incident shows that some tasks have a threshold from "infeasible" to "feasible," and AI model iterations may cross that line directly after a given update.
The Barrier of "Security Through Complexity" Is Disappearing
The Hacktron team wrote in its research report: "Software has long benefited from a security mechanism achieved through complexity. AI is converting more scarce expertise into computational capability, thereby eliminating this protection. Work that once required a well-resourced team and months can now be compressed into days, and security assumptions must keep up with attackers' capabilities."
This passage points to a structural problem, not an isolated case. The underlying logic of traditional enterprise security architecture is that the cost of launching advanced attacks is far higher than the upper limit of most attackers' capabilities; therefore, technically secure but misconfigured systems can still operate by relying on a "complexity barrier." This barrier is not written in any security document, but it has long existed in reality.
AI is systematically dismantling this barrier. Hacktron's three-person team, with less than $3,000 in compute costs, completed within 72 hours a chain of work that previously required a professional team with penetration testing, reverse engineering, and vulnerability development skills. They do not believe their capabilities are comparable to state-sponsored advanced attack teams, but they did do what only the latter could previously do. This is not because the upper limit of human capability has risen, but because tools have lowered the threshold.
Anthropic itself confirmed this trend in its cyber threat intelligence report released in September 2026: over the past few months, the company found multiple cases of attackers using Claude for cyber intrusions, malware development, credential collection, and data processing. The report explicitly states that AI is narrowing the technical and manpower gap that previously existed between well-resourced nation-state attack teams and individual attackers.
OpenAI: Repeatedly Facing Problems of Its Own Making
This incident is one facet of OpenAI's recent security troubles. In July 2026, OpenAI disclosed that its self-developed "agent swarm" breached the production infrastructure of AI startup Hugging Face during a cybersecurity test. Anthropic subsequently disclosed that Claude models had accidentally entered real third-party systems during cybersecurity evaluations. On September 16, OpenAI released a framework for reporting anomalous model behavior, publishing six anomalous or concerning model behaviors observed over the previous six months and admitting that previous related disclosures had been "too fragmented."
OpenAI President Greg Brockman said this week that the company at one point reassigned about 25% of its production engineers from existing projects to security defense work, and that an internal large-scale review found and fixed multiple serious issues. This figure means that one of the most technically aggressive AI companies is shifting considerable R&D resources toward defense itself—in part because the tools it helped build are making such defense more difficult.
Regarding this intrusion, OpenAI confirmed two issues were involved: first, the libheif vulnerability in third-party service Discourse, and second, OpenAI's own permission configuration flaw. The company subsequently narrowed the permission scope of community login tokens and revoked affected tokens and sessions. Discourse also independently released a security advisory and fixed the vulnerability on July 28.
The Tool-Choice Paradox in the Competitive Landscape
One detail sparked additional discussion in tech circles: the core tool used to breach OpenAI was Anthropic's Claude. The two companies are the most direct competitors in the large-model field, and Anthropic's model was used to complete a penetration test of its rival AI company's systems. This narrative of "using a competitor's weapon against the competitor" gives the security incident drama beyond the technology itself.
But this is not logically strange: the essence of penetration testing is thinking from an attacker's perspective, and attackers are not constrained by "you may only use the target's tools." What is truly worth asking is: where exactly are the capability boundaries of the special version of Claude that Anthropic opens to cybersecurity professionals? Who is eligible to apply for access? Is the review mechanism sufficiently robust?
$6,500: Reasonable Reward or Underestimated Risk?
Another number worth examining is the bug bounty itself. Is $6,500 commensurate with its actual value for completing an attack demonstration covering the full chain from forum server RCE to internal Monorepo read-write access?
Bug bounty programs are essentially a limited-reward social contract. They can attract ethical researchers to disclose responsibly, but they cannot stop malicious actors with the same technical capabilities from choosing to sell the same vulnerabilities on dark web markets. When AI tools dramatically lower the cost threshold for vulnerability discovery and exploitation, the value of vulnerabilities may rise and fall in the market at the same time, but there is not yet sufficient data to judge which direction the combined force of these two factors points.
Conclusion: Rewriting Security Models Is Urgent
The most sober reading of this incident is not "OpenAI was hacked," but a more general conclusion: a large number of existing enterprise security architectures rely on an assumption that is failing—that attackers' capabilities have an upper limit, and that this limit is lower than the current cost of protecting systems. Hacktron's three-person team punched through this assumption in 72 hours with facts, and their capability boundary will be pushed outward again with the release of the next Opus version, the next Gemini version, and the next o-series version.
Every asymmetric leap in offensive and defensive capabilities in history has forced defenders to rewrite security models—from cryptography to firewalls, from firewalls to endpoint detection, and now to this. AI has accelerated the industrialization of exploitation. This does not mean defense is helpless, but it does mean that "wait and see" is no longer a security option. Systems that still rely on the logic that "the attack is too complex, so no one will probably do it" should treat this report as a formal invalidation notice.
© 2026 Winzheng.com 赢政天下 | 转载请注明来源并附原文链接