Claude couldn't hack OpenAI. Then Anthropic shipped Opus 5
4 hours ago
- Hacktron AI exploited a heap buffer overflow in libheif used by Discourse, triggering code execution on OpenAI's forum via a crafted HEIC image.
- The bug was disclosed via CVE-2026-32882 and advisory GHSA-vhm9-85gw-x335, rated 8.8 CVSS; it remained unpatched in the deployed Debian package due to lack of backport labeling.
- The initial exploit failed against memory protections; Claude Opus 4.8 only worked with memory randomization off, but the released Opus 5 succeeded in under 3 hours against ARM64 and gained remote code execution in ~7 hours.
- Claude autonomously developed exploits when pointed at a local instance via a fake CTF URL, demonstrating capability in memory-corruption exploitation.
- The researchers chained plugin exploits: over-permissioned SSO tokens granted API access to employee accounts, leading to Codex and private GitHub access, enabling a harmless pull request in OpenAI's monorepo.
- The full attack chain: HEIF upload → libheif overflow → RCE on forum → SSO token abuse → employee account → GitHub → PR.
- The 'HEIF Heist' project cost under $3,000 in tokens over two months; OpenAI paid a $6,500 bounty and fixed the token permissions.