On July 24, a security research team called Hacktron spent hours trying to turn a known bug in an old image-processing library into a working exploit against OpenAI’s help forum. It didn’t work.
That same evening, Anthropic released Claude Opus 5. The researchers pointed the new model at the same problem and had a working exploit in three hours. By the next morning, they had remote code execution on OpenAI’s own forum. By early afternoon, they had used that access to reach an employee’s ChatGPT and Codex accounts, and opened a pull request inside OpenAI’s internal code repository to prove it. OpenAI fixed the underlying issue within a day and paid a $6,500 bounty for the report.
Nothing about the bug, the team, or the target had changed between the failed attempt and the successful one. A single model release turned a dead end into a full breach in under a day.
Model lock-in is a new vulnerability #
Most security teams plan for attackers getting more capable over time. Few plan for how short the window is between a model shipping and someone pointing it at them the same evening. The bug that made this breach possible had actually been fixed over a year earlier, quietly, without anyone flagging it as a security issue. Nobody at OpenAI or Discourse was looking for it, because nothing told them to look. Catching a change like that requires something that reads the code and understands what it does. A scanner that checks packages against a list of publicly reported bugs wouldn’t have caught it, because this one was never on a list.
The jump that let Hacktron turn a dead end into a breach in under a day works the same way for whoever’s defending the code. Opus 5 didn’t just make attackers faster. It made anything that reads code and reasons about it faster, including the tools meant to catch this kind of gap before it ships. We built Kilo model-agnostic for that reason, so a team’s tooling moves at the pace of the frontier.
Kilo’s Code Reviewer running on Auto Frontier is the direct version of that. Auto Frontier automatically rotates between the best available models across all providers, so you never have to manually update anything to keep your stack running on the frontier. That way, a team running Code Reviewer might have picked up whatever Opus 5 saw on July 24, the same evening Hacktron did, without anyone touching a config file or waiting on approval. Auto Efficient runs the same check against Kilo Bench, our own coding benchmark, and picks the cheapest model still proven capable on the task, so you can keep near-frontier quality at a fraction of the price.
The fix that mattered in the Hacktron case was buried a layer down, in a package most engineers never open by hand, changed by someone who wasn’t trying to flag a security issue at all. Kilo’s Codebase Indexing is built for exactly that kind of problem: semantic search across a repository that finds where a dependency actually gets used, not just where its name appears in a file. Pointed at a codebase the size of Discourse’s, that surfaces every place an old image library got pulled in, including the ones nobody remembers adding.
Flex to the frontier #
The researchers said that once they had this exploit working, adapting it to a new target usually took a day or two. A team reviewing its own dependencies on a slower cycle than that is already behind their pace, not some future version of it. Model-agnostic tools are built for that pace: access to whichever of the 500-plus available models fits the moment, not the one approved last quarter.
If your product touches HEIC or AVIF images anywhere, the patched library version and fix instructions are in the researchers’ original writeup here, and you can get started with Kilo Code here.