Hacktron had a bug and no way to use it.

Their team spent several sessions pointing the security-researcher build of Claude Opus 4.8 at a memory flaw in libheif, trying to get a working exploit out of it. Nothing. Then Anthropic shipped Opus 5, they handed it the identical problem, and it worked within hours.

The vulnerability had been sitting there for months. What changed overnight was the cost of weaponizing it.

The three jumps

On July 25 the team uploaded a crafted HEIF image to OpenAI’s community forum.

That forum runs Discourse. Discourse hands images to ImageMagick, and for HEIF files ImageMagick leans on libheif, which is where the memory bug lived. It miscalculated where the image data sat, and that was enough to run code on the forum server. Discourse patched it two days later.

From that foothold, a second flaw in OpenAI’s single sign-on let them take over employee ChatGPT and Codex accounts. Codex was wired into OpenAI’s GitHub organization.

Public forum. Employee account. Internal source code. Three jumps, reported by TechCrunch on September 18.

OpenAI paid 6,500 dollars for the write-up.

Your peripheral systems share your identity

This is the part I want every technology lead to sit with.

The forum held nothing worth stealing. No customer data, no model weights, no keys. It was valuable only because it authenticated against the same identity provider as the tools that mattered.

Now go make that list for your own company. The support portal. The status page. The event microsite marketing stood up in 2023 that nobody has touched since. The survey tool somebody expensed. None of them store anything. All of them trust the same login.

Architecture diagrams do not include these. Asset inventories built from the product repo do not include these. They show up in exactly one place, which is the list of applications registered with your identity provider, and that list rarely gets read as a threat model.

We covered the same boundary from the delegated-permission side in OAuth and the attack surface. Different door, same building.

The cost curve moved, the skill requirement did not

Matt Fredrikson, who runs Gray Swan, gave TechCrunch the quotable version: for 200 dollars a month, anyone can use these tools and hack into a company like OpenAI.

I would push back on the “anyone” a little.

Three experienced researchers still had to know which peripheral service to probe, recognize that an image pipeline was the soft spot, and spot that the forum and the developer tooling shared an identity boundary. That is judgment, and it did not get cheaper.

What got cheaper is the middle of the work. Turning a documented memory bug into reliable exploit code used to require a specialist and days of effort. Now it is a prompt and a model release away. Anthropic’s own threat report describes the same shift from the defender’s side.

So the honest read is not that attacks became trivial. It is that the gap between “we know about this bug” and “someone is inside” collapsed from weeks to hours, and your patch window was sized for weeks.

One exercise, this week

Export the list of every application registered with your identity provider.

For each one, answer two questions. If someone executes code inside it, what can they reach? And if it breaks tomorrow, who finds out?

Most lists of this kind contain at least one system that no current employee claims to own. That one is your forum.

We run this as part of a software audit, because an identity boundary is invisible from inside the product codebase. It only shows up when you look at what is hanging off the edges.

Let’s inventory what hangs off your single sign-on