Anthropic's Opus 5 helped security researchers break into OpenAI's private repos in under 72 hours

Security researchers at Hacktron AI demonstrated a concerning capability gap between AI model generations when they deployed Anthropic's newly released Opus 5 against a series of vulnerabilities. In less than three days, the model successfully orchestrated a multi-stage attack chain that culminated in reading from OpenAI's private monorepo — something its predecessor, Opus 4.8, could not accomplish.

The Foundation: An Overlooked Vulnerability#

The attack began with a hidden defect in libheif, an image library used by Discourse forum software. OpenAI's community forum, built on Discourse, relied on an outdated version (1.19.7) that contained a heap buffer overflow flaw triggered by specially crafted HEIC or HEIF image files. Though the upstream maintainers had patched the bug months earlier, the fix was never formally assigned a CVE identifier and therefore never backported into Debian's version — allowing the vulnerability to persist undetected.

Hacktron adapted the exploit to target Discourse's specific memory configuration and architecture, turning a malformed image file into remote code execution on the forum server.

The Unexpected Door: Over-Permissioned Tokens#

Breaking into the forum itself would have been a contained incident. The real breach came from a design flaw in OpenAI's single sign-on system: authentication tokens issued to forum users carried far broader permissions than necessary, granting full API access to linked ChatGPT and Codex accounts — many of which belonged to OpenAI employees. These employee accounts, in turn, connected directly to OpenAI's GitHub environment, opening a path to the company's internal openai/openai repository.

Opus 5's Autonomous Assault#

What distinguishes this incident is how Hacktron then validated the threat: they ran the attack sequence again with Anthropic's Opus 5 operating in an autonomous agent loop, with minimal human guidance. The model successfully reproduced remote code execution, identified the over-permissioned tokens, pivoted to an employee's Codex account, and accessed the private monorepo—all without direct instruction for each step.

The researchers added one crucial barrier: Opus initially refused to target live remote systems. They circumvented this safety measure by proxying their test instance through a URL (rce.ee/ctf-forum) that disguised the attack as a legitimate capture-the-flag exercise.