Claude Opus 5 Hacked OpenAI's Forum in Bounty Test
A three-person team at Hacktron AI chained two flaws in OpenAI's community forum, succeeding only with Opus 5, and collected a $6,500 bounty.
In short
Three security researchers at the startup Hacktron AI used Anthropic's Opus 5 model to take over OpenAI's community forum through a crafted HEIF image, then reached employee accounts and the company's GitHub organization.
At a glance
- Three-person team at startup Hacktron AI; Opus 4.8 failed across several sessions, Opus 5 produced the exploit within hours.
- First breach on July 25, 2026; Discourse shipped a fix on July 27, 2026.
- Two chained flaws: a memory bug in libheif plus an account-takeover flaw in Discourse.
- OpenAI paid a $6,500 bug bounty and confirmed the vulnerabilities are resolved.
- Gray Swan CEO Matt Fredrikson: at $200 a month, this class of attack is open to almost anyone.
A three-person team at the security startup Hacktron AI used Anthropic's Opus 5 to take over the forum software behind OpenAI's community site, and from there reached ChatGPT and Codex accounts belonging to OpenAI employees as well as the company's GitHub organization. OpenAI paid $6,500 through its bug bounty program and confirmed the vulnerabilities have been fixed.
The front door was an image upload
The weak point was not OpenAI's own infrastructure but Discourse, the third-party software running its community forum. A memory miscalculation in libheif, the library behind Apple's HEIF/HEIC image format, could be triggered by a specially built picture file. That was enough for the researchers to run instructions of their own on the forum server.
A second Discourse flaw then let them take over user accounts, including those of OpenAI staff. Only the combination of the two turned an ordinary upload into account access. TechCrunch dates the first breach to July 25, 2026, with a Discourse fix arriving two days later.
The model generation mattered
The interesting part is the timing rather than the bug chain itself. According to Hacktron founder Mohan Pedhapati, Opus 4.8 spent several sessions without producing a working exploit. Given the same problem, Opus 5 solved it within hours of shipping.
How the labor split between the model and the three humans is not spelled out in the reporting. What the account does show is one model generation moving the line of what an attacker can pull off, with no extra effort on the attacker's side.
What it costs to try
Matt Fredrikson, CEO of the security firm Gray Swan, frames the case around price: for $200 a month in subscription fees, this class of tooling is available to practically anyone, including for an attempt against a company like OpenAI. Set against that is the $6,500 paid out for the disclosed finding.
What is still unverified
Only the TechCrunch report loaded for this article; the Ars Technica and Verge accounts could not be retrieved and therefore could not be cross-checked. That leaves the depth of the GitHub organization access unconfirmed, along with what was actually visible there.
It is also unclear whether Anthropic's safeguards engaged during the attempt. TechCrunch notes that Opus 4.8 was used in a version aimed at security researchers, but records no refusals and no statement from Anthropic. Beyond confirming the fix, no direct OpenAI comment is documented.
FAQ
Was OpenAI itself hacked?
The entry point was Discourse, the third-party software behind OpenAI's community forum. From there the researchers reached employees' ChatGPT and Codex accounts and the company's GitHub organization.
Which Claude model was used in the attack?
Opus 4.8, in the version aimed at security researchers, failed across several sessions. Opus 5 succeeded within hours of its release.
Has the vulnerability been patched?
Discourse shipped a fix on July 27, 2026, and OpenAI confirmed the fix and paid a $6,500 bounty. Anyone self-hosting Discourse with image uploads should stay on current versions.
