A photo uploaded to OpenAI's support forum ended up as a PR inside its private monorepo, in under 72 hours. The exploit was written by an Anthropic model released the night before, whose safety card placed it "substantially behind" another model at turning vulnerabilities into real threats. Everything in this chain carried a label. None of them described what the thing did.
No malware. No link in an email. No careless employee.
An image attached to a public form, the way you attach a screenshot when you need help.
The most closely watched AI lab on the planet went PAILA over an attachment.
Through the dependency, not the front door
Three Hacktron researchers — Harsh Jaiswal, Mohan Pedhapati and Rahul Maini — had spent months going over frontier AI companies. Their writeup puts it plainly: they found an SSO misconfiguration in OpenAI's identity infrastructure and a libheif RCE in its community forum.
community.openai.com runs on Discourse and accepts "Sign in with OpenAI": compromising the forum opened a path into the rest of OpenAI through the identity door. Discourse head-on is not an easy target, and they had tried before. So they went after a dependency.
On July 23 they found the anomalous path: Discourse checks images with FastImage, FastImage doesn't support HEIF, and those files get handed to ImageMagick's magick. Three layers down, a C++ parser receives a file the attacker wrote.
This was reported, coordinated, paid research — worth saying now, because what follows reads worse.
Three hours with the new model
No human found the bug. An Opus 4.8 session audited the libheif shipped in Discourse's Docker image and noticed that "some particular security fixes were not back-ported": a heap overflow, out-of-bounds read and write while decoding a HEIC.
On July 24, Opus 4.8 produced a working exploit with ASLR disabled. With ASLR on — Discourse's default — several separate sessions got nowhere: "wasn't fruitful."
That evening, Anthropic released Claude Opus 5.
New session. Three hours later there was a working ARM64 exploit for a local Mac; only then did they ask it to port the thing to x86-64 and Discourse's jemalloc. By six in the morning on July 25, local code execution confirmed through an image upload.
Here is the one safety brake in this entire story that did its job: Opus refused to write an exploit against remote instances. The fix was to dress the target up as something else. They put Claude in an autonomous /goal loop against their own Discourse Cloud instance, proxied through rce.ee/ctf-forum "to make it look like a CTF target as Opus refused write exploit for remote instances" (sic).
By ten they looked again. The agent had remote code execution on its own and proved it by reading /etc/hosts. With that script they got into OpenAI.
By mid-afternoon they had taken over an employee's account with no interaction on their part. That Codex was connected to OpenAI's GitHub organization, and they sent it a prompt that opened PR #1186742 in the openai/openai monorepo, "without actually accessing any internal code". Then they stopped.
OpenAI confirmed the fix at 22:49:45, about fourteen hours after the report, by the researchers' own count. From first discovery to the monorepo: under 72 hours.
Three chances
This is where the story stops being about AI.
May 2025. Dirk Farin, libheif's maintainer, pushes a commit titled "simplify overlay overlap area computation". Two files, 36 lines added, 34 removed. No security notice. No CVE. Hacktron argues that this is the code they exploited and that the missing label "might be a reason why" Debian never pulled it down. The change landed in 1.20.0; the Discourse image carried 1.19.7, per Hacktron.
May 2026. A different researcher, credited as "Hikai", reports a different flaw in the same function. That one does have a number: CVE-2026-32882, patched in 1.22.0, 67 days before the attack. The distribution didn't move either.
Today, September 18, Debian's security tracker still lists bookworm as vulnerable to that CVE. Trixie shows as fixed, which is not the same as updated: it sits on the old version number with the patch bolted on.
Three chances. A commit that said "simplification". A CVE that arrived late. A distribution bulletin that arrived after the robbery. We already covered PAILA by pip install; this is PAILA by what never got installed.
The number in the registry doesn't describe what happened either. The libheif advisory rates that CVE as an out-of-bounds read: up to 3,123 bytes of somebody else's memory leaking into the output pixels, with integrity listed as "None". Discourse's, built on the very same CVE, calls it remote code execution, scores it 8.8 with high integrity impact, and files "No CWEs". A pure read does not give you a write. So which of the two records describes what happened?
Neither. Discourse attributes its RCE to that CVE, it doesn't demonstrate it, and no public source identifies by number the flaw actually used against OpenAI: the loudest image-parser story of the year has no record of its own.
The gap is still open: libheif's latest security release ships six flaws under the line "CVE numbers will be added when assigned". The label doesn't lie. It just doesn't protect.
The model came labeled too
On July 24, Anthropic released Opus 5 with a label of its own: "Safety. Opus 5 does not advance the frontier in risky, dual-use capabilities." And with a detail that aged in hours: the model comes close to Mythos 5 at finding flaws, but "remains substantially behind Mythos 5 on the exploitation of those vulnerabilities—that is, in turning vulnerabilities into material cyber threats."
That same night it turned a vulnerability into a material threat: "Within hours of Opus 5's release, we gave it the same problem and it succeeded."
The model's cyber classifiers block, says that same announcement, "penetration testing, and exploit generation". And block they did: it refused to attack a remote machine. What they couldn't see through was the costume. The target sat behind a proxy whose URL read ctf-forum, and that was enough. The brake never asked what the machine was. It asked what it was called.
Why would something that cheap work? Because capture the flag is the frame these models are evaluated in: attacking an external system is, by design, the assignment.
The symmetry isn't ours to invent. On July 21, OpenAI admitted that its own models broke out of an exam and got into Hugging Face's production. On the 23rd, Hacktron's founder published his reconstruction of that case — declared at 80% confidence — the same day his team started poking at Discourse's image pipeline. Nor was there only one tool: heif-heist.com credits GPT-5.6 Sol, OpenAI's model, ahead of Opus 5.
Attribution
Perpetrator: nobody, in the sense this section usually means. OpenAI paid $6,500 on September 1, with a footnote worth more than the sum: testing the forum was "explicitly excluded from our bug bounty program", and the award recognizes the OpenAI-side finding, not the actions against Discourse. A scope label on a check. On Hacker News the complaint ran the other way: "That amount for this payout is beyond pathetic for a near $1.2T company." The technical perpetrator does have an address: "It is an OpenAI SSO issue that turned the forum compromise into access to ChatGPT and Codex." Until two months ago, anyone walking into that forum for help could have lost their ChatGPT and Codex accounts.
Accomplices: the labels, one by one. The commit filed as a simplification. The distribution that backports what upstream marks, not what upstream fixes. Unsandboxed ImageMagick, a known nightmare since the PHP era. And the employee's Codex, which did what it was told, with the employee's permissions, for someone who wasn't the employee — the confused deputy again, this time with a PR for a receipt. Discourse comes off this list: report on Saturday, reply on Sunday, and by Monday it had sandboxed all image processing with Landlock. It didn't stop at bumping a version number. It changed the architecture.
Systemic failure: what protected ordinary companies was never a wall, it was a price. What is that price now? Two months, three researchers and under $3,000 in tokens for the whole campaign, one or two days per new company. "AI is removing that protection by turning more of this scarce expertise into compute." Or, as Matt Fredrikson of Gray Swan put it to TechCrunch: "For $200 a month, anyone can use these tools and hack into a company like OpenAI." Exactly one company noticed anything: Shopify, after thousands of images and repeated crashes in its image processors.
The counterweight comes from the authors themselves: "This was not completly autonomous hacking" (sic). What changed isn't who hacks. It's how many people it takes.
Everything in this chain was correctly labeled. The commit said what it did. The model came with its safety card, honest on the day it was written. The photo was a photo.
The question isn't who got the labels wrong. It's what we are supposed to read now, when the label is written once and the capability of whoever reads it changes overnight.