Claude Helps Breach OpenAI: AI Penetration Costs Under $3,000
nashnova research
A three-person security team used Anthropic's Claude Opus 5 to breach OpenAI's internal code repository in under 72 hours, spending less than $3,000 in total token costs — this means → AI is dragging nation-state-grade hacking capability down to a $200-per-month subscription anyone can pick up.
How did a single image lead to OpenAI's core codebase?
The entry point was OpenAI's community forum image upload feature: when users upload HEIC-format images, the parsing library libheif — a low-level component that handles Apple's common photo format — contains a heap buffer overflow vulnerability.
This means → an attacker only had to upload one crafted image to achieve remote code execution on OpenAI's server.
The catch: a patch for this vulnerability was completed a year earlier, but because it was never flagged as security-related and never assigned a CVE, the Docker image running OpenAI's forum never received the fix.
In plain terms = the patch existed but nobody knew to install it — that gap is exactly where the image slipped through.
Once inside the forum, how did they escalate to employee accounts?
The second vulnerability sat in OpenAI's single sign-on (SSO) — a unified login system that connects one account to all services. Attackers leveraged code execution on the forum server, combined it with the SSO authentication flaw, and directly hijacked accounts of users who had logged into the forum — including OpenAI employees.
Those employee accounts were linked to Outlook, Gmail, Google Drive, Slack, and GitHub — this means → the attack surface extended far beyond ChatGPT itself; one entry point pried open an entire ecosystem.
To prove the breach was real without touching sensitive data, the team picked an employee account connected to OpenAI's GitHub organization and used its Codex access to submit a harmless pull request (PR #1186742) to OpenAI's internal monorepo.
The team emphasized: the SSO flaw is not Discourse-specific — any first- or third-party service using OpenAI SSO, once compromised, yields the same account takeover.
What exactly made Opus 5 stronger than the previous version?
The team first used Opus 4.8 to audit the Docker image. It found the unbackported security fix and built a partially working exploit — but under real-world conditions with ASLR enabled (address space layout randomization — a defense that scrambles memory addresses), it failed to produce a stable exploit across multiple attempts.
Hours after Opus 5 launched, the team fed it the same problem. It produced a working exploit in 3 hours — first for ARM64, then ported to x86-64.
In plain terms = 4.8 could find the hole but couldn't build a weapon that worked; 5 built one outright — a qualitative leap from "vulnerability discovery" to "working attack code."
To bypass Opus 5's safety refusal to attack live servers, the team proxied the target to masquerade as a capture-the-flag (CTF) challenge domain — this reflects how fragile current model safety guardrails remain.
What do $3,000 and two months really mean?
The entire project took roughly two months. Three researchers did all the work. Total LLM token cost: under $3,000. Adapting the exploit to each new target typically took one to two days.
This means → penetration capability that once required a large team and months of R&D can now be replicated by three people and a credit card.
Follow-up investigation revealed the same libheif vulnerability also affected Slack, Meta, GitHub Enterprise, Ruby on Rails, and multiple Node.js frameworks — apart from Shopify, no company detected the attack activity, even as the attackers sent thousands of images and crashed image-processing workers multiple times.
Gray Swan CEO Matt Fredrikson put it bluntly: "For $200 a month, anyone can use these tools to hack into a company like OpenAI."
How wide is the gap between regulation and model capability?
Claude Opus 5 — the version that cracked the exploit — currently faces no security export restrictions. Its successor Mythos 5 has been temporarily locked over concerns about advanced hacking capability.
This reflects the mismatch between regulatory pace and model evolution: capability is already deployed in the field while restrictions are just beginning to be discussed.
Open-source models are catching up fast: SaferAI found that Chinese firm Z.ai's GLM-5.2 trails GPT-5.5 and Opus 4.7 in cyberattack capability by only a few months.
In plain terms = the software industry's long-standing reliance on "complexity as security" is breaking down — the scarce expertise once required for hacking is being leveled by AI tools, and how fast that window narrows will determine whether existing security frameworks can hold.
How did OpenAI and Discourse respond?
OpenAI patched the SSO issue within roughly 14 hours of receiving the report. On September 1 it paid the team a $6,500 bounty, specifying the reward covered the SSO finding — penetration testing of the Discourse forum itself fell outside OpenAI's bug-bounty scope.
Discourse received the report on Saturday, replied Sunday, had a patch ready Monday, and began sandboxing ImageMagick. It published security advisory GHSA-vhm9-85gw-x335 on July 28.
The team also found that when blind-targeting completely unknown environments, GPT-5.6 Sol showed stronger adaptability than Opus 5 — this means → the capability race between models is playing out in the security arena in parallel.
市场有风险，内容仅供研究参考，不构成投资建议。