72 hours to an internal repository changes the patching clock, not the vulnerability class

Hacktron reported that three researchers moved from initial discovery to access to an OpenAI internal repository in less than 72 hours. The chain began in the image-upload path behind OpenAI's Discourse forum, crossed an OpenAI SSO weakness, and ended with access to employee ChatGPT and Codex accounts. The team proved the impact by asking an employee's Codex to open a harmless pull request in OpenAI's internal monorepo, then stopped.

The headline is easy to make about Claude Opus 5. Hacktron says Opus 4.8 could not make its libheif exploit reliable with ASLR enabled, while Opus 5 produced a working ARM64 exploit within three hours of release. That capability jump matters. The operational failure, however, was older and less exotic: reachable parsing code had missed a security-relevant upstream fix because the change was not labelled as a vulnerability.

No CVE does not mean no patching clock

Hacktron found that HEIC and HEIF uploads bypassed Discourse's usual FastImage path and reached ImageMagick, which delegated decoding to libheif. The vulnerable upstream code had already changed the previous year, but the commit was not documented as a security fix and had no CVE. Debian 12 therefore still supplied the affected libheif 1.19.7 in the forum image.

AI is compressing exploit development faster than vulnerability metadata can describe the exposure.

That creates a specific problem for vulnerability management. A queue driven mainly by CVSS, CVE publication and scanner signatures can be late to a flaw whose fix already exists upstream. Internet-reachable parsers for images, documents, archives and media deserve a second signal: security-relevant upstream changes in dependencies that process attacker-controlled input.

Identity made a parser bug systemic

The image flaw alone compromised the forum environment. The larger blast radius came from identity architecture. Hacktron says an OpenAI SSO issue allowed the forum compromise to become ChatGPT and Codex account access, including an employee account connected to GitHub. OpenAI confirmed its side of the issue was fixed roughly 14 hours after submission and later paid a $6,500 bounty for the OpenAI-side finding.

The review therefore cannot stop at the vulnerable package. Teams should map what a compromised application session can federate into, which connected services inherit that identity, and whether a lower-trust community or support property can become a bridge into engineering systems. SSO reduces authentication friction; it also propagates the consequences of a weak relying party when trust is too broad.

Prioritise reachable parsers and trust edges

The Monday change is concrete. Inventory externally reachable file-processing paths and their native dependencies, isolate those processors in hardened ephemeral sandboxes, and track upstream security fixes even when no CVE exists yet. Then threat-model every SSO relying party as a potential pivot: minimise scopes, require fresh authorisation for sensitive connectors, and prevent a forum session from silently inheriting developer authority.

Model-assisted exploitation does not create a new vulnerability class. It changes the economics and the time available to respond. Vulnerability programmes should shorten the path from an upstream fix to production remediation where attacker-controlled input and high-value identity trust meet.

Written by the Devence Lab research team.