Researchers used Claude to walk into OpenAI's internal repos
Two stories about the same thing from opposite ends: a security firm used one lab's models to break into its rival, and a coding agent got a feature for finding what the humans never got around to looking for. Plus a local-inference release that argues the number everyone ranks quants by is measuring the wrong thing.
A security company used Anthropic's models to reach OpenAI's internal GitHub repositories in under 72 hours, chaining a heap overflow in an image decoder with a misconfiguration in OpenAI's single sign-on. Hacktron published the writeup, and the mechanics matter more than the headline: the entry point was community.openai.com, the Discourse forum hosted in OpenAI's own infrastructure, which accepted HEIC image uploads and decoded them through libheif — where a heap buffer overflow gives out-of-bounds read/write primitives. The upstream fix for that bug had landed the previous year without being labelled a security patch and without a CVE, so Debian never backported it in time, and the vulnerable release was still shipping in Debian 12 and 13 images when Discourse built its Docker container. From forum access, Hacktron says, an OpenAI SSO misconfiguration turned a compromised Discourse account into the member's ChatGPT and Codex login. They took over an employee account whose Codex was wired into the company's GitHub organization, and to prove impact without reading any code, they asked that employee's Codex to open a pull request in OpenAI's internal monorepo, then stopped.
That last step is the whole story. The agent was the pivot, not the target: nobody had to steal a session cookie or crack a password when a connected coding agent already had repository permissions on the employee's behalf. OpenAI patched roughly 14 hours after the report and paid a $6,500 bounty, while noting that testing against the forum was explicitly excluded from its bounty program — an award for the SSO finding, not for the route taken to reach it. The detail labs will be quoting all week is model progress inside the exploit itself: Claude Opus 4.8 produced a working ImageMagick and libheif exploit only with address-space randomization disabled, and could not make it reliable against Discourse's default configuration; Opus 5 shipped that evening, and the retry succeeded within hours. Hacktron is explicit that this was not autonomous hacking and that human guidance still mattered, which is exactly why it's a warning — the scarce part of exploit development is becoming a model release note. We covered the same week's toolchain-side version of this problem — Plugin4Shell: a zero-click RCE hits all four major coding agents — and the pattern holds: the agents' permissions are the attack surface, and the patches are landing one vendor at a time.
Cognition gave Devin a feature that runs the other direction: instead of waiting for a task or reviewing a diff, Code Scans takes a goal — "find unused code," "cut Rust compile time," "fix these structured-data bugs" — and investigates a whole repository against it. Devin studies the codebase first and defines rules for the symbols, modules and dependencies relevant to that goal, then processes the batches in a map-reduce pass the company says guarantees coverage of every selected batch. Findings come back ranked with evidence attached, and the agent can then open PRs for the ones you pick. The examples Cognition published are refreshingly mundane: a heavyweight web dependency only used by a default feature flag, a foundational crate whose generated element tables force full downstream recompiles, an expired event page still indexable with a meta description advertising registration as open.
That's less exciting than a launch demo and more useful. The bottleneck for most of these jobs was never the fix, it was the week of reading before you could start — and the risk profile is different too: a scan that reads everything is cheap to be wrong about, while an agent that edits everything is not. The obvious open question is precision at scale, which is why the customer examples are all small and verifiable.
ByteShape shipped the full ShapeLearn quantization run for Qwen 3.8 27B, and used it to argue that the metric the community ranks quants by doesn't predict task performance. The company's first pass, published days after the model's August release, used a deliberately smaller optimization budget; the finished set covers five sizes, and by ByteShape's own benchmarks it now occupies the entire quality-versus-throughput frontier across all six GPUs it tested, from a 96 GB RTX Pro 6000 down to 16 GB cards. The pointed part is the KLD section: Unsloth's UD-IQ3_S diverges about 20 percent less from the full-precision model than a comparably sized ShapeLearn-Lite quant, yet scored lower on the benchmark suite — 95.55 percent versus 97.33 percent of the full-precision score. ByteShape also measured speculative decoding on the new models, finding DFlash2 reached 1.34× to 2.10× baseline token throughput against 1.28× to 1.66× for the embedded MTP path, at the cost of roughly 1.1 GB more memory and no image input in llama.cpp. The takeaway for anyone picking a quant off a leaderboard this week: KLD tells you how much the distribution moved, not whether the tasks you care about got worse.
What to watch: whether OpenAI restructures what a connected Codex account can reach, and whether KLD's demotion from ranking metric to diagnostic holds up on other model families.
Should a lab be liable when an agent it connected to a corporate repository becomes the pivot into that company's code? Tell us in the comments.
