AI‑driven exploit automation moved from research prototype to production‑grade capability when Anthropic released Claude Opus 5. Within hours the model generated a working ARM64 exploit for a heap overflow in libheif, chained it to remote code execution on a Discourse forum, and leveraged over‑permissive SSO tokens to reach an OpenAI employee’s Codex account and a private GitHub repository.
Exploit Development with Claude Opus 5
The Hacktron AI team first tried Claude Opus 4.8 on July 24. The model succeeded only when the target system’s address space layout randomization (ASLR) was disabled, a configuration that does not exist on production servers. Anthropic’s subsequent release, Opus 5, removed that limitation. Within three hours the model produced a functional ARM64 exploit that ran on a Mac workstation, and four hours later it achieved remote code execution against a test Discourse forum instance. The researchers then placed the model in an autonomous loop, giving it a goal and a target URL. The model completed the loop by reading /etc/hosts inside the compromised container, demonstrating that the AI could drive the full exploitation workflow without human intervention.
Supply‑Chain Weaknesses in Image Handling
Discourse, the forum software used by OpenAI’s community site, relies on FastImage to screen uploaded images. FastImage does not support HEIC/HEIF formats, so those files are handed to ImageMagick for decoding. ImageMagick invokes libheif, and the Debian 12 base image shipped version 1.19.7, which contains a heap buffer overflow (identified as CVE‑2026‑32882 and advisory GHSA‑vhm9‑85gw‑x335) with a CVSS score of 8.8. The upstream fix existed but was not back‑ported to the Debian package because the commit lacked a security label and no CVE was assigned. Consequently, any Discourse deployment using that base image remained vulnerable to a crafted HEIC file.
Over‑Permissive SSO Tokens
Beyond the image‑processing flaw, Hacktron discovered that the Discourse single‑sign‑on (SSO) implementation issued tokens with broader permissions than required. The tokens granted full API access to the linked ChatGPT and Codex accounts, some of which belonged to OpenAI employees. One employee’s Codex account was connected to OpenAI’s GitHub environment, providing a path from the forum to private repositories. Using that access, the researchers opened a harmless pull request in the openai/openai monorepo, proving the breach without further damage. OpenAI responded by tightening token scopes, revoking the compromised sessions, and paying a $6,500 bounty for the SSO issue.
Related CloudNinjas coverage: AI engineering.
What This Means For Practitioners
Practitioners should treat AI‑driven exploit automation as a realistic threat vector. The rapid progression from vulnerability discovery to remote code execution demonstrates that large language models can now handle complex memory‑corruption exploitation steps when provided with sufficient compute budget. Key actions include:
- Maintain up‑to‑date image‑processing libraries and ensure security patches are back‑ported to base images, especially for components like
libheifthat may be invoked indirectly. - Audit SSO token scopes and enforce the principle of least privilege for any federated identity flow. Verify that tokens issued to third‑party services do not expose full API access.
- Monitor model token usage and consider policy controls that restrict autonomous agents from executing code generation or system‑level commands without explicit review.
- Incorporate AI‑model behavior into threat modeling. Assume that an adversary could employ a capable LLM to automate exploit development, and test defenses accordingly.
By tightening supply‑chain dependencies, tightening identity permissions, and accounting for AI‑assisted attack automation, teams can reduce the attack surface exposed by both vulnerable libraries and over‑permissive authentication flows.
