[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"news-slug-hacktron-claude-openai-monorepo-rce-72h":3,"topics-all":40,"news-related-fa4c43df-5d62-464b-b4b0-3a6854000644":59},{"id":4,"title":5,"summary":6,"content":7,"original_url":8,"source_id":9,"tags":10,"translations":27,"news_slug":33,"published_at":34,"created_at":35,"modified_at":36,"is_published":37,"publish_type":38,"image_url":14,"view_count":39},"fa4c43df-5d62-464b-b4b0-3a6854000644","AI 攻破 OpenAI 内网全程复盘:靠 Anthropic 模型当武器,72 小时打开自家后门","Three researchers used Claude (Opus 4.8 to Opus 5) to chain a libheif bug and OpenAI SSO flaw and reach an internal GitHub monorepo in 72 hours.","一支只有三人的安全团队用 Anthropic 的 Claude 当外壳,把对手 OpenAI 的内部仓库打开了一扇门——还给 OpenAI 自己留了个无害的 PR 当\"到此一游\"凭证。这场从 7 月 23 日拖到 7 月 28 日、最终在 9 月才公开披露的事件,是 AI 辅助攻击能力又被测了一次,只不过这次的靶子恰好就是 OpenAI。\n\n## 入口是一张 HEIF 图\n\n攻击起点非常朴素——OpenAI 的社区论坛 community.openai.com 的图片上传功能。这个论坛用的是 Discourse,默认会用 FastImage 做图片检查;但 FastImage 不支持 HEIF 格式,所以 HEIF 文件被甩给了下一棒:基于 ImageMagick + libheif 的转换链路。问题就出在这里:上游 libheif 的维护者其实在 2025 年就改过出问题的那段代码,但那次提交**没被标记为安全修复、也没分到 CVE 编号**,所以 Discourse 在用的旧版本里它还在原地。Hacktron 的 Harsh Jaiswal、Mohan Pedhapati、Rahul Maini 三人组吃到了这个\"明明修过但没人下游打\"的福利:他们上传一张特殊构造的 HEIF 文件,直接拿到论坛服务器的 RCE 权限([theregister.com](https:\u002F\u002Fwww.theregister.com\u002Fsecurity\u002F2026\u002F09\u002F18\u002Fresearchers-used-claude-to-hack-openai-employees-chatgpt-accounts\u002F5297517))。\n\n## Claude 在这个过程里干了什么\n\nHacktron 公开的复盘里有一段很关键的细节对比:**Opus 4.8 能写出能跑的 exploit 代码,但只在 ASLR(地址空间布局随机化)关掉的环境下才稳定**——现实部署默认是开着的,所以这条路没走通。然后 7 月 24 日晚上 Anthropic 发布 Opus 5,三人组随即切到新模型。报告里写得很直白:\"在新模型上,本地 Mac 环境三小时就拿到了可工作的 exploit 代码,接下来才把它移植到 Discourse 的服务器环境。\"这一步之后,他们用 Claude 在自己的测试环境里反复迭代,直到能直接对着 OpenAI 的真论坛打。\n\n整条链路时长:**从 7 月 23 日第一次接触,到 7 月 25 日拿到初始入口,再到 Codex 接管员工 GitHub 权限并开了一个无害的 PR,全程不到 72 小时**([xenospectrum.com](https:\u002F\u002Fxenospectrum.com\u002Fen\u002Fclaude-openai-hack-security-boundaries))。他们明确停了手,声称没有读任何内部代码或敏感数据。\n\n## SSO 是第二个放大器\n\n光拿论坛 RCE 还不够——真正让这次能\"打到员工账户\"的,是 OpenAI 的 SSO 配置。用户如果用 OpenAI 凭据登录过 community.openai.com,这层会话状态就能直接复用到 ChatGPT 和 Codex 上;换句话说,**论坛一旦失守,等于把所有\"拿 OpenAI 账号登录过论坛的人\"的 ChatGPT\u002FCodex 全部推到了悬崖边**。XenoSpectrum 的复盘把这层放大效应单独列了出来:这不是 Discourse 的锅,是 OpenAI 自己服务之间的信任边界设计。\n\n紧接着,Codex 通过员工的 GitHub organization 权限被触达,Hacktron 立刻演示了\"在 openai\u002Fopenai monorepo 里开个 PR\",作为访问能力的实证。Discourse 在 7 月 28 日发了 CVE-2026-32882 公告和 GHSA-vhm9-85gw-x335 安全公告,打了 image-processing 沙箱;OpenAI 在收到报告 14 小时内修完了自己那侧、撤销了相关 token,并在 9 月 1 日通过 Bugcrowd 付了 6500 美元赏金——但明确说明\"对 Discourse 那部分的测试本来就不在赏金范围,这笔钱只为认可 OpenAI 自己的发现\"。\n\n## 模型换了,Exploit 难度变了\n\n这是这次事件里最值得拉出来的对比点。Hacktron 的复盘提供了一个干净的 A\u002FB:**同一个 CVE、同一组研究人员、同一台目标机,Opus 4.8 写得出的代码在 ASLR 默认开启的环境里跑不动;Opus 5 在相同研究流里把可用 exploit 的时间压到了小时级**。他们没有任何并行 benchmark,这就是个案例报告,但它指向一个老问题——防御方评估攻击方能力时,如果还停留在\"去年的模型大概能做到哪\",这个时间常数在被 Opus 5、GPT-5、未来的新一代继续压缩。\n\n那个被反复引用的不到 3000 美元 token 成本数字,实际覆盖的是**整个\"HEIF Heist\"项目两个月跨多家公司的总开销**,而不是 OpenAI 这一单的支出,且不含人力成本。把它当\"攻破 OpenAI 的全部账单\"是误读,但反过来——\"两个月 + 三个人 + 不到 3000 美元 token,就能打到一家头部 AI 实验室的内网代码库\",这个事实本身已经够防御界睡不着觉。\n\n## 防御侧的三个独立检查点\n\n把 Hacktron 的攻击路径和 Discourse 的修复公告并排放,真正需要运营方单独复核的不是\"打了补丁没\",而是这三件事是否分别到位:\n\n- **入口层**——fix 后的 image 包是否真的落到了运行镜像里。光有上游 patch 不算部署。\n- **跨服务认证**——一个服务被攻破后,能不能横向扩到另一个服务的权限。OpenAI 这侧的回答是\"不能\",这次的现实是\"能\"。\n- **开发环境权限**——把 Codex 类 AI agent 接到员工的 GitHub organization 时,真实可执行操作的边界到底划在哪。\n\n把这三件事拆开看,任何一件不到位,类似的链式攻击都能再来一次。\n\n## 一行结论\n\nClaude 没\"黑掉\"OpenAI,**但它把研究-到-exploit 的时间常数从月压缩到了天**,而且这件事就发生在做出最先进模型的那家自己身上;赏金 6500 美元并不是\"OpenAI 不在意\"的信号,而是 bug-bounty 报价模型还没追上模型能力的那条曲线([theregister.com](https:\u002F\u002Fwww.theregister.com\u002Fsecurity\u002F2026\u002F09\u002F18\u002Fresearchers-used-claude-to-hack-openai-employees-chatgpt-accounts\u002F5297517))。\n","https:\u002F\u002Fxenospectrum.com\u002Fen\u002Fclaude-openai-hack-security-boundaries","ec2dc025-8d7e-442b-9b19-b58a5e52a59f",[11,15,18,21,24],{"id":12,"name":13,"slug":13,"description":14,"color":14},"1fcfaaf2-67de-43d3-9e35-5784852fec60","ai-safety",null,{"id":16,"name":17,"slug":17,"description":14,"color":14},"40269b40-7942-4650-9672-ed2e6524d37a","ai-technology",{"id":19,"name":20,"slug":20,"description":14,"color":14},"23544f6a-eea1-4f05-aa8d-749ca862d5d2","anthropic",{"id":22,"name":23,"slug":23,"description":14,"color":14},"dca4d0ab-7994-43a7-839e-7756fc77344a","claude",{"id":25,"name":26,"slug":26,"description":14,"color":14},"e82b2d09-81b2-43d1-977e-e018443b3c14","coding-agent",[28],{"id":29,"lang":30,"title":31,"summary":6,"content":32},"ea755794-4352-4c63-b460-c3fcb984fdd5","en","Hacktron used Claude to reach OpenAI monorepo in 72 hours","A three-person security team used Anthropic's Claude as the shell to open a door into OpenAI's internal code repository, and even left a harmless pull request as a calling card. Running from July 23 to July 28 and finally disclosed in mid-September, this is another data point on AI-assisted attack capability — except this time the target *was* OpenAI.\n\n## Entry point: a HEIF image\n\nThe starting point was mundane: the image upload on OpenAI's community forum, community.openai.com. The forum runs on Discourse, which defaults to FastImage for image checks. FastImage doesn't understand HEIF, so HEIF files fall through to the next layer — an ImageMagick + libheif conversion chain. The bug lived there. The upstream libheif maintainer had actually changed the offending code in 2025, but the change **wasn't tagged as a security fix and never got a CVE ID**, so the version Discourse was running never picked it up. Hacktron's Harsh Jaiswal, Mohan Pedhapati, and Rahul Maini got to exploit a fix that nobody downstream had deployed: upload a crafted HEIF, get remote code execution on the forum's server ([theregister.com](https:\u002F\u002Fwww.theregister.com\u002Fsecurity\u002F2026\u002F09\u002F18\u002Fresearchers-used-claude-to-hack-openai-employees-chatgpt-accounts\u002F5297517)).\n\n## What Claude actually did\n\nHacktron's writeup has a sharp before-and-after detail: **Opus 4.8 produced working exploit code, but only when ASLR (Address Space Layout Randomization) was disabled** — and real deployments keep ASLR on, so that path didn't ship. Then on the evening of July 24, Anthropic released Opus 5, and the trio switched models. The report states plainly: \"With the new model, working exploit code for a local Mac environment came together in three hours; the remaining work was porting it into Discourse's server environment.\" After that, they let Claude iterate inside their own test rig until the code worked directly against OpenAI's live forum.\n\nFull timeline: **initial contact on July 23, initial entry on July 25, then Codex taking over an employee's GitHub permissions and opening a benign PR — under 72 hours total** ([xenospectrum.com](https:\u002F\u002Fxenospectrum.com\u002Fen\u002Fclaude-openai-hack-security-boundaries)). The team stopped explicitly and said it didn't read any internal code or sensitive data.\n\n## SSO was the second amplifier\n\nForum RCE alone wasn't enough — what let this actually reach employee accounts was OpenAI's SSO setup. Anyone who logged into community.openai.com with OpenAI credentials had that session state reusable on ChatGPT and Codex. In other words, **a forum breach effectively pushed every ChatGPT\u002FCodex account that had ever logged into the forum straight to the edge**. XenoSpectrum's breakdown flags this amplification separately: this is not Discourse's fault; it's an OpenAI-side trust boundary between its own services.\n\nCodex was then accessed via an employee's GitHub organization permissions, and Hacktron immediately demonstrated a PR opening in the openai\u002Fopenai monorepo as proof of access. Discourse published CVE-2026-32882 and security advisory GHSA-vhm9-85gw-x335 on July 28, adding image-processing sandboxing. OpenAI patched its side within 14 hours of the report, revoked the affected tokens, and paid the 6,500 USD bounty on September 1 via Bugcrowd — explicitly noting that \"testing against the Discourse-hosted community.openai.com was outside the bounty scope; the award recognizes the OpenAI-side finding, not the Discourse actions.\"\n\n## The model switch changed the exploit difficulty\n\nThe cleanest A\u002FB in the report. **Same CVE, same researchers, same target — Opus 4.8 produced code that wouldn't run under ASLR; Opus 5 compressed the working exploit time into hours in the same research flow**. There's no parallel benchmark here; it's a single case report. But it points at the same old question: when defenders still reason from \"what last year's model could do,\" that time constant keeps getting eaten by Opus 5, by GPT-5, by whatever ships next quarter.\n\nThe figure that keeps getting quoted — \"under 3,000 USD\" in tokens — actually covers the **whole \"HEIF Heist\" project across two months and multiple companies**, not just the OpenAI leg, and it excludes labor costs. Reading that as the price tag of \"hacking OpenAI\" is wrong, but the underlying fact — \"two months, three people, a few thousand dollars in tokens, reaching a top AI lab's internal code repo\" — is already alarming for defenders.\n\n## Three independent defensive checkpoints\n\nLining up Hacktron's attack path against Discourse's fix advisory, what operators actually need to verify separately isn't \"did we patch,\" but whether each of these three things is independently in place:\n\n- **Entry layer** — did the fixed image package actually land in the running image? An upstream patch isn't a deployment.\n- **Cross-service authentication** — once one service is breached, can the impact propagate to another service's permissions? OpenAI's intended answer here was \"no\"; the reality was \"yes.\"\n- **Development-environment permissions** — when an AI agent like Codex is wired into an employee's GitHub organization, what is the actual ceiling on real actions?\n\nAny one of those failing, the same chained attack runs again.\n\n## Bottom line\n\nClaude didn't \"hack\" OpenAI, **but it compressed the research-to-exploit time constant from months to days, and the target was the company shipping the most capable models**. The 6,500 USD bounty isn't a signal that OpenAI doesn't care — it's a bug-bounty pricing model that hasn't caught up with what the models can do ([theregister.com](https:\u002F\u002Fwww.theregister.com\u002Fsecurity\u002F2026\u002F09\u002F18\u002Fresearchers-used-claude-to-hack-openai-employees-chatgpt-accounts\u002F5297517)).\n","hacktron-claude-openai-monorepo-rce-72h","2026-09-21T03:00:00Z","2026-09-21T11:05:21.990489Z","2026-09-21T11:05:21.990508Z",true,"agent",1,[41,50],{"slug":42,"tag_slug":42,"title_zh":43,"title_en":44,"intro_zh":45,"intro_en":46,"id":47,"is_active":37,"created_at":48,"modified_at":49},"ai-for-science","AI for Science 2026：从 UniPert 到 GPT-Rosalind 的硬核进化","AI for Science 2026: from UniPert to GPT-Rosalind","生命科学、化学材料、物理世界模型——AI 正在从\"语言工具\"变成\"实验伙伴\"。本专题收录 AI 在三大科学方向的关键节点：UniPert 统一基因与化学扰动空间、GPT-Rosalind 端到端生命科学推理、达摩院 AI 智能体 28 小时找到 4 种超导新材料、Anthropic Claude Science 把工作台做成标准品。","From language tool to lab partner — AI is reshaping life sciences, chemistry\u002Fmaterials, and physical world models. This topic covers the key milestones: UniPert unifying genetic-chemical perturbation spaces, GPT-Rosalind's end-to-end life-sciences reasoning, DAMO's AI agent discovering 4 superconducting materials in 28 hours, and Anthropic's Claude Science workbench going mainstream.","988a4300-5fab-41c4-b5d8-63711a2dc757","2026-09-10T01:34:15.296649Z","2026-09-10T01:34:15.296663Z",{"slug":51,"tag_slug":51,"title_zh":52,"title_en":53,"intro_zh":54,"intro_en":55,"id":56,"is_active":37,"created_at":57,"modified_at":58},"h3-series","MiniMax H3 系列：从开源权重到 35 倍吞吐","MiniMax H3 Series: from open weights to 35x throughput","MiniMax H3 自 2026 年 8 月开源以来节奏密集：官方把生成、参考与编辑收回一个模型；ComfyUI 当天压进 RTX 3060；摩尔线程 3 小时完成国产 GPU 适配；fal 后训练版把吞吐拉到 35 倍；FastH3 蒸馏再砍推理成本。本专题持续追踪 H3 的发布—开源—蒸馏—部署全链路。","Since MiniMax open-sourced H3 in August 2026 the pace has been relentless: one unified omni-modal model, same-day ComfyUI support down to an RTX 3060, a 3-hour Day-0 port to Moore Threads GPUs, fal's post-trained H3 Max at 35x throughput, and FastH3 distillation cutting inference cost further. This topic tracks the full H3 chain — release, open weights, distillation, deployment.","83ef0daa-3c31-4cb3-86ed-e5ee58654d5f","2026-09-08T07:33:19.942193Z","2026-09-08T07:33:19.942209Z",{"items":60},[61,66,71,76,81,86],{"id":62,"title":63,"news_slug":64,"published_at":65},"fb57f44e-cb62-4ea4-b519-4a4521c06794","「越狱评分」也可以 CVSS 化:CJS 框架把 LLM jailbreak 拆成五档严重度,Anthropic 牵头联合四家推标准","cjs-jailbreak-severity-cvss","2026-07-05T00:01:00+00:00",{"id":67,"title":68,"news_slug":69,"published_at":70},"8a5451e5-dca1-4416-84da-b06b31b03c49","Claude Code 在系统提示里悄悄埋 Unicode 标记：开发者工具的暗信号边界在哪","claude-code-prompt-steganography","2026-07-01T02:01:00+00:00",{"id":72,"title":73,"news_slug":74,"published_at":75},"01d2337b-9e24-4b10-9902-b330af7801a9","Fable 5 回归:Anthropic 用「jailbreak 严重度框架」+ 新分类器重写安全基线","fable-5-redeploy-jailbreak-framework","2026-07-01T00:00:00+00:00",{"id":77,"title":78,"news_slug":79,"published_at":80},"f3d17d45-e1a8-4a1b-9449-6813aff06e49","Anthropic 让 Claude 自己修对齐:10 类失败全部见效,还超过人类研究员","claude-automated-alignment-researchers","2026-08-29T13:05:00+00:00",{"id":82,"title":83,"news_slug":84,"published_at":85},"97c97b9c-e6e4-4982-aa57-0c0da814fb19","Anthropic 的欧盟答卷四小时即被撕开：Claude 文本水印为什么怕改写","claude-synthid-70-percent-threshold-bypass","2026-08-21T08:00:00+00:00",{"id":87,"title":88,"news_slug":89,"published_at":90},"470b8663-3916-4bc5-ac3c-c592487c2873","Claude水印官宣4小时被破:开源去除工具走红,水印军备竞赛开场","claude-watermark-removal-tool","2026-08-20T19:30:00+00:00"]