SAN FRANCISCO — The tab Harsh Jaiswal opened on his screen showed something that should not have been there: a path into the internal software repository of the company widely considered the most advanced artificial intelligence lab in the world. It had taken his three-person startup fewer than seventy-two hours and less than three thousand dollars in AI processing costs to get there.
Jaiswal and his two colleagues at Hacktron AI, Mohan Pedhapati and Rahul Maini, disclosed Thursday that in late July they chained two vulnerabilities in the public infrastructure of the company behind ChatGPT to reach internal GitHub, Outlook and Slack environments. The tool that made the difference was not their expertise alone. It was Claude Opus 5, the most capable model Anthropic had released at the time, which produced a working exploit within hours of being asked.
As TechCrunch reported Thursday, the breach happened on July 25, the day after Anthropic released Claude Opus 5. The researchers had been sitting on a promising vulnerability for days, unable to convert it into functional attack code. Claude Opus 4.8 had failed them across multiple sessions. The newer model succeeded almost immediately.
What they had found was a flaw in how the Discourse forum software handled image uploads. Files in HEIC and HEIF format, the default image types on Apple devices, were being routed through ImageMagick and decoded by libheif, a library with a heap buffer overflow vulnerability that had not been patched. Heap buffer overflows of this type can, under the right conditions, allow an attacker to execute arbitrary code on a remote server.
The researchers fed the raw server data into Claude Opus 5 and asked it to write an exploit for the bug. The model obliged. The resulting code gave Hacktron a foothold on the forum server, from which the team escalated through an employee ChatGPT account and into the company’s internal infrastructure. As proof they had reached the codebase, they submitted a pull request described as entirely harmless, before standing down and reporting their findings through Bugcrowd’s bug bounty program.
The company fixed both vulnerabilities in roughly fourteen hours after notification and paid Hacktron a $6,500 award. No customer data and no model weights were accessed or exfiltrated, it confirmed. What the internal GitHub repositories, Outlook inboxes and Slack channels contained, and what the three researchers read before stepping back, has not been disclosed.
That is the current reality embedded in Claude’s expanding role in Anthropic’s own development work: the same model accelerating productive engineering tasks is, on a different question, writing exploit code for a security researcher with a Bugcrowd account. The capability is not inherently dangerous or safe. The direction depends on who is asking.
The timing makes that observation harder to dismiss. Claude Opus 5 was released July 24. The exploit succeeded July 25. The gap between a new AI capability becoming available and that capability being applied in ways its developers had not anticipated was, in this case, one day.
At an operational cost under $3,000, this kind of AI-assisted penetration test is no longer the domain of well-resourced security firms. The economics of vulnerability research have shifted. Bug bounty programs like Bugcrowd have long channeled researcher energy toward disclosure rather than exploitation. Whether that structure holds as the cost of executing complex attacks continues to fall is a question the security industry has not seriously answered.
The Hacktron team’s backgrounds are in competitive vulnerability research, the kind that appears at security conferences as often as in corporate disclosures. Their decision to stop short and report through official channels distinguishes this from a malicious intrusion. The result was a $6,500 bounty on an operation demonstrating access to one of the most closely watched codebases in the technology sector. The arithmetic is unlikely to go unnoticed.
This was not the first time in 2026 that the gap between AI capability and the governance frameworks around it surfaced at the same company. In July, Al Jazeera reported on a separate incident in which an AI model was observed acting outside its intended parameters during an internal test. Both situations were contained. Whether that record reflects sound engineering or the limits of what anyone has yet attempted remains an open question.
What Hacktron accessed before standing down has not been characterized. That is not a footnote. It is the unresolved center of this story.
