Claude Opus 5 used to breach OpenAI forum in under 72 hours

OpenAI is getting a taste of its own medicine, as the article puts it: after inadvertently letting agents hack their way across the internet for months, the company has now been hacked with AI's help. The intrusion ran through community.openai.com, and anyone who had used "Sign in with OpenAI" there was potentially affected, since users can connect GitHub, Slack, and email to Codex and ChatGPT. The researchers used an employee's Codex account to create a harmless pull request in the internal monorepo to prove access, and say they did not view any sensitive data.

Two separate weaknesses made the chain possible. The first was in libheif, the library the forum used to process uploaded HEIC images; a fix had been available in the original source code for a year, but the Debian packages on the forum still lacked it. The second was a misconfiguration in OpenAI's central SSO system, which let anyone controlling the forum server impersonate active members and take over their ChatGPT and Codex accounts. The researchers say the flaw extended beyond the forum to any compromised service using OpenAI login.

The wider "HEIF Heist" investigation, covering Slack, Meta, GitHub Enterprise and other targets, is where the stakes become clearer. Three people spent two months and less than $3,000 on AI, and only Shopify noticed the activity despite thousands of image uploads and repeated crashes in image processing. Hacktron argues that threat models must reflect how cheap attacks have become, since complexity no longer shields companies the way it once did. Whether that argument changes how other firms prioritize known-but-unpatched bugs in their own stacks is likely to depend on how quickly similar scans surface elsewhere.