Three people. One image upload. Under 72 hours, from a public community forum to the inside of OpenAI's internal code repository. That is not a movie plot — it happened on July 25, 2026.
A three-person security research team called HacktronAI — Harsh Jaiswal, Mohan Pedhapati, and Rahul Maini — was working through OpenAI's bug bounty program. Their weapons were not exotic: an aging open-source image library with a known-but-unpatched vulnerability, and Claude Opus 5, released by Anthropic just one day earlier. OpenAI paid them a $6,500 bounty and fixed its side of the flaw in roughly 14 hours.
Most coverage framed this as a delicious irony: OpenAI, maker of GPT, got hacked with Claude. The irony is fun, but it obscures what actually matters.
What actually happened is that an assumption the software industry has quietly relied on for decades just failed a live test — and the failure showed up on a receipt.
1. The Attack Chain Isn't the Story. The Cost Is.
Start with the mechanics, because they are almost boring. OpenAI's community forum runs on Discourse. When users upload HEIC or HEIF images, Discourse's usual image-checking tool, FastImage, can't handle the format, so files get passed to ImageMagick, which calls the libheif decoder underneath. libheif contained a heap buffer overflow. Here's the kicker: upstream had fixed it a year earlier, but the fix wasn't tagged as a security patch and never received a CVE identifier. So Debian 12 and 13 never received the backport. Discourse's Docker image, based on Debian 12, shipped the vulnerable libheif 1.19.7.
A malicious HEIF upload triggered remote code execution (RCE) on the forum server. Then the second bug took over: OpenAI's single sign-on had an authentication misconfiguration, which let the team hijack the ChatGPT and Codex accounts of anyone who had logged into the forum — including OpenAI employees. One employee's Codex was connected to OpenAI's GitHub organization, so the team used it to open a harmless pull request, #1186742, into OpenAI's internal monorepo as proof — without reading a single line of internal code.
Every link in this chain would have read as "advanced persistent threat" material three years ago. What changed the game wasn't the chain. It was the price tag attached to it.
The team first tried Claude Opus 4.8 on July 23. It found the unbackported fix and built a partially working exploit — but against Discourse's real configuration with ASLR (address space layout randomization) enabled, multiple sessions failed to produce a reliable exploit. On the evening of July 24, Anthropic released Opus 5. A fresh session produced a working ARM64 exploit for a local Mac within three hours, then ported it to Discourse's x86-64 environment and jemalloc allocator overnight. By 6:00 a.m. on July 25, local RCE via image upload was confirmed. The team then put Claude into an autonomous loop, proxying the target through a domain dressed up as a CTF challenge to slip past its refusal to attack real remote servers. At 10:00 a.m., the agent had RCE on Discourse Cloud, verified by reading /etc/hosts.
A task where the previous generation of the model repeatedly failed was finished by the new generation the day after its release.
2. How "Security Through Obscurity of Effort" Actually Worked
To see why this is a watershed, look at the old defensive model.
For three decades, internet defense has rested on an assumption nobody writes into compliance documents: complexity is a free moat. Even a public memory-corruption vulnerability, with source code sitting on the table, required three scarce resources to become a working weapon against a production system.
First, expertise: researchers who understand heap layouts, allocator behavior, and ASLR bypass are rare. Second, time: weeks to months of reverse engineering and debugging. Third, environment intelligence: deep knowledge of the target's exact configuration.
Multiply the three, and exploit development cost so much that only nation-state actors bothered — and only for high-value targets. Everyone else's security strategy compressed into one sentence: attackers won't bother with us. This is "security through the expense of exploitation" — not that you defended well, but that attacking you made no economic sense.
Notice what AI did here. It did not discover the vulnerability. The libheif bug already existed; the fix already sat in an upstream repository. AI did the second half of the work: turning a theoretical bug into a reliable weapon against a specific environment. And that second half is precisely where the three scarce resources used to be consumed.
3. Exploit Economics: The New Pricing Model
Here is a reusable frame: any attack's feasibility can be priced by three inputs — the cost of knowledge, the cost of time, and the cost of intelligence. In the old equilibrium, these multiplied into nation-state budgets. AI commoditized all three at once.
Knowledge cost: Opus 4.8 audited a Docker image and found an unbackported security fix. Opus 5 wrote an ARM64 exploit and ported it across architectures and memory allocators overnight. Skills that once commanded expert salaries now cost an API call.
Time cost: from "new model released" to "reliable production-grade exploit" took about a day, not months. The team also observed perceptible capability jumps between model generations. In later testing, GPT-5.6 Sol reportedly operated fully blind — knowing only that a vulnerability existed — and autonomously chained memory leaks, privilege escalation, and lateral movement.
Intelligence cost: adapting the exploit to each new target took one or two days. The follow-up project, HEIF Heist, proved the economics at scale: two months, covering Slack, Zoom, Meta, GitHub Enterprise, Ruby on Rails, and Node.js frameworks including Next.js, Astro, and Gatsby. Three researchers. Total token spend: under $3,000.
The total price of an attack fell from a national budget to a few thousand dollars. The pricing model of offense changed. Most organizations' threat models have not.
One colder detail: throughout the HEIF Heist research, the team sent thousands of images that repeatedly crashed target companies' image-processing pipelines. Aside from Shopify, not one company detected the attack activity.
4. This Was Never About OpenAI. It's About the Dependency Chain.
Push the frame outward, and the blast radius covers far more than one company.
libheif is textbook invisible infrastructure: buried inside countless applications' image pipelines, remembered by no one. The famous xkcd #2347 cartoon describes exactly this structure — all modern digital infrastructure resting, precariously, on some unnamed volunteer's small library. This time, the fix had been written a year earlier. It failed to propagate merely because it wasn't labeled as a security patch and got no CVE. An entire downstream distribution ecosystem went blind over a missing label.
Two things follow. First, any application that accepts HEIC/HEIF/AVIF uploads and processes them server-side carries the same exposure. Second, attackers can now systematically sweep an entire ecosystem — while defenders don't even receive crash alerts. The gap isn't technical. It's economic: in the old world, nobody paid the cost, so nobody actually attacked.
For the security industry, the same weapon appreciates in reverse. An AI that writes exploits can also run continuous automated penetration testing, dependency audits, and patch-coverage checks. Hacktron itself is productizing these capabilities into pull-request security review tooling. Offense and defense now hold the same hammer. The only question is who systematizes it first.
5. What You Should Do
- Security leaders: Rewrite your threat model and delete the line that reads "attackers won't target us." Re-score your exposure with exploit economics in mind — when every input cost approaches zero, low target value is not a defense.
- Infrastructure teams: Audit your image-processing pipelines now. Anything accepting HEIC/HEIF/AVIF should run the latest patched libheif and libde265 (upstream security release v1.23.4 as of September 14, 2026). Disable formats you don't need via ImageMagick's security policy, and sandbox image processing in isolated, ephemeral environments.
- Dependency management: Stop watching only CVEs. This incident's root cause was a fix that shipped without a security label. For critical dependencies, track upstream commits themselves, not just advisories.
- Application vendors: Add crash monitoring to image-processing workers. The industry-wide silence during HEIF Heist means the cheapest possible detection signal was never deployed.
- Model providers: Treat this as an alignment stress test. A fake CTF domain was enough to bypass Opus's refusal to attack real remote servers. Guardrail boundaries need recalibration against real attackers' disguise techniques.
"Security through expensive exploitation" wasn't destroyed by any single breach. It was ended by a token bill under $3,000.
When the expertise behind attacks becomes purchasable compute, security economics must be rebuilt. This time, defenders hold the same tools.
Sources: Hacktron AI, "Hacking OpenAI"; heif-heist.com; Discourse advisory GHSA-vhm9-85gw-x335; Debian security advisory DSA-6417-1.