Hacktron cleared roughly $3,500 on the exploit chain that reached OpenAI's GitHub

The spend side comes from one line in the Indian Express report, carried without attribution, which says the three "hacked OpenAI with Opus 5 in 2 days for <$3000" ^[14]. Treat that as the cost and OpenAI's $6,500 payment ^[5] leaves about $3,500 ^[1], or roughly $1,167 a researcher ^[2], which across two days is about $583 each a day ^[3]. Gross return on spend, a little over two times ^[4]. For three people who can chain an image parser into a private code host, that day rate is below what the work bills at, and the published result is worth more to a cybersecurity startup than the payment.

The first bug was in someone else's code. Hacktron's account says the work began on July 23 on OpenAI's community forum, which runs Discourse, where the team found a flaw in the handling of HEIC/HEIF image files that researchers traced to the libheif library in the processing chain ^[3]. Hacktron reported the vulnerabilities to OpenAI and to Discourse ^[5]. The expensive step was the second one, where access to several employees' ChatGPT and Codex accounts carried into OpenAI's private GitHub environment ^[2], and the team proved it by creating a pull request through a compromised employee's Codex account ^[6].

This was an authorised test under a bug-bounty process, and there is no evidence Hacktron downloaded sensitive source code or accessed model weights ^[11]. The researchers said they stopped testing once they had established they could potentially reach sensitive internal material, and that they did not read or download OpenAI's private source code ^[9]. OpenAI said it fixed the vulnerabilities and revoked affected authentication tokens and sessions ^[10].

On the claim that frontier models are making offensive work cheaper, the evidence here is one chain against one target. The Indian Express report says the incident proves AI reduces the time required to move from finding a vulnerability to exploiting it, and that human researchers still drove the strategy and the operation ^[12]. The sequencing fits: attempts with Claude Opus 4.8 failed to produce a reliable exploit, and Anthropic released Claude Opus 5 on July 24 ^[4]. Two readings survive those facts. In one, the model release cut the cost of exploit development enough to change who can do this work. In the other, the binding weaknesses were a third-party image library and the credential path from an employee's Codex account into private GitHub, and both were there before any model touched them ^[3][2]. I lean to the second. What would move me is several bounty programmes reporting two-day chains from researchers without this team's track record.