AI Security Breach: Claude Opus 5 Hacks OpenAI Employee Accounts Post-Release

Claude Opus 5, a new AI model, hacks into multiple OpenAI employee accounts just hours after its release. This breach, orchestrated by the three-person security startup Hacktron AI, exploited a memory bug in the libheif library through HEIF image uploads to the OpenAI community forum, which runs on Discourse. The attack resulted in the takeover of several ChatGPT and Codex accounts, leading to unauthorized access and a pull request.

Hack Details Unveiled

Hacktron AI, a small but skilled security firm, identified and chained two OpenAI vulnerabilities. The first was a memory bug in the libheif library, which they accessed via HEIF image uploads to the OpenAI community forum. This allowed them to gain control over multiple OpenAI employee accounts, including those for ChatGPT and Codex.

The attackers then opened a pull request, demonstrating the extent of their access and the potential for further damage. This incident highlights the critical need for robust security measures in AI systems, especially as they become more integrated into everyday operations.

Industry Context and Implications

The breach comes at a time when AI security is under increasing scrutiny. As AI models like Claude Opus 5 and others from companies such as Alibaba and StepFun continue to evolve, the risk of such attacks grows. Alibaba recently released Qwen3.8-Omni-Flash, an omnimodal model that processes text, images, audio, and video with a 1M-token context. This model, while impressive, also underscores the importance of securing these advanced systems.

StepFun's launch of the 600B-parameter sparse MoE model, Step 5 Preview, further emphasizes the rapid advancements in AI. However, these developments come with significant security challenges. The industry must prioritize robust testing and security protocols to prevent similar breaches in the future.

Future Outlook

As the AI landscape continues to expand, the need for stringent security measures becomes even more critical. Companies must invest in comprehensive security audits and continuous monitoring to protect against vulnerabilities. The recent breach serves as a stark reminder of the potential risks and the importance of staying ahead of emerging threats.

References

• AI News Today, September 20: Top Stories | AI Weekly