Key Takeaways
- Hacktron AI reported the OpenAI chain through Bugcrowd on July 25, 2026, and collected a $6,500 bounty.
- Claude Opus 5 produced a working ARM64 exploit in hours after Opus 4.8 failed the same task.
- Chainalysis logged 11.1 malicious onchain writes a day, up from 2.06, as open models spread.
The Chain, Link by Link
A vulnerable ‘libheif’ library inside Discourse, the forum software, allowed remote code execution (RCE) on the forum itself. From there the team pivoted through a flaw in OpenAI’s single sign-on (SSO) flow, took over an employee’s ChatGPT account, and reached the Codex environment wired to OpenAI’s GitHub organization.
That opened the openai/openai monorepo, from where the researchers (affiliated with the security startup Hacktron AI) opened a harmless pull request to prove they were inside and stopped short of examining sensitive source code.
The work happened in late July, with the team reporting the developments through OpenAI’s Bugcrowd program on July 25 and the vulnerability was fixed the same day; Discourse published its advisory on July 28 with a Common Vulnerability Scoring System (CVSS) severity of 8.8, and the whole thing only became public on Sept. 17 when the Wall Street Journal reported it.
A Model Change Was All That Was Needed
The interesting part is not that OpenAI had a bug because every software company encounters them from time to time. It is what closed the gap between finding one and weaponizing it.
The team first tried Claude Opus 4.8 but found it unreliable for the task. They then switched to Claude Opus 5, released July 24, and produced a working ARM64 exploit within hours, then adapted it for x86-64 and jemalloc environments. Memory-corruption exploit development is specialist work that has historically taken skilled humans weeks, but in this case, the entire series of events unfolded in less than three days.
Implications For Crypto
Crypto is where such digital proficiency can show up as money rather than a simple pull request. Numbers-wise, Chainalysis reported this week that attackers all over the world are posting malware instructions to public blockchains 440% more often than a year ago, with daily malicious onchain writes climbing from 2.06 to 11.1.
The firm tied the jump to mid-2025, when open-weight Chinese models launched without meaningful guardrails against writing malicious code, and called the technique blockchain dead drops, i.e., command-and-control instructions parked on a ledger that no one can seize or take offline. By the second quarter of 2026, state-linked operators from North Korea and Iran were accounting for roughly two-thirds of new activity and about half the total.
Researchers tracking North Korea’s Kimsuky found local large language model (LLM) platforms, including Ollama, GPT4All and Msty, installed on the group’s infrastructure alongside AI-generated phishing decoys aimed at virtual asset and financial investment targets. Blockaid counted 212 onchain exploits worth $1.1 billion as AI and wallet attacks accelerated, and Defillama recorded April 2026 as crypto’s most-hacked month on record with 30 incidents.
The ones defending themselves from these attacks are feeling the heat ever more increasingly, with Coinbase recently warning that bug reports could triple in the near future as AI floods disclosure programs with noise, which is the awkward corollary of a $6,500 bounty being enough to surface a three-stage chain into a major lab.
Regardless, exploit development is becoming a major commodity service and if the numbers are anything to go by, its prevalence will only keep increasing.
