Opus 5 found the crossing in three hours

On July 25, 2026, Hacktron chained two vulnerabilities to take over OpenAI employee ChatGPT and Codex accounts and opened pull request 1186742 in OpenAI's internal repository via a GitHub-connected Codex. The chain runs: a libheif heap overflow (a missing Debian backport, no CVE) into ImageMagick, into a Discourse image upload on community.openai.com, into an auth.openai.com SSO misconfiguration, into ChatGPT and Codex, into the GitHub connector, into internal repositories.

The genuinely interesting part is the model that did it. Claude Opus 4.8 failed to beat address space layout randomization across sessions. Opus 5, hours after its July 24 release, produced a working ARM64 exploit in about three hours. The agent was proxied through rce.ee/ctf-forum to present as a capture-the-flag target, because Opus refused to write exploits aimed at remote or live instances.

So the read on this is a capability crossing, not a security story: one model could not clear a threshold, the next model could, and the crossing took hours. OpenAI fixed its half of the chain in roughly fourteen hours and paid $6,500. Discourse shipped GHSA-vhm9-85gw-x335 (CVE-2026-32882, CVSS 8.8) on July 28.

This has been told two ways. The first is the HEIF-Heist ecosystem vulnerability, a broad look at a class of parsing libraries and the ImageMagick and libheif fallbacks that make it reachable. The second is the clean capability datapoint: the ASLR threshold that Opus 4.8 could not clear and Opus 5 cleared in hours. The log is a record of emergent behavior and the gap between design and reality — and models are increasingly useful for that. The second narrative is the one this log is for.

One source-level wobble: Hacktron's own write-up names the model Claude Opus 5.5 in places and Opus 5 elsewhere. Most coverage, and this entry, use Opus 5.