Every outlet covering yesterday’s OpenAI breach ran the same frame: a rival lab’s model was used to hack OpenAI. Almost nobody led with the two things in the researchers’ own writeup that actually matter to anyone running agents in production, so that is where I am starting.
Opus 5 Did in Three Hours What Opus 4.8 Could Not Do in Days
Three researchers at Hacktron AI, Harsh Jaiswal, Mohan Pedhapati and Rahul Maini, chained a memory bug and a misconfiguration to get from OpenAI’s public help forum into OpenAI’s private monorepo. Their own account of the work is far more useful than the coverage of it.
Here is the part that got buried. They started reviewing libheif on July 23. On July 24, Claude Opus 4.8 produced an exploit that only worked with address space layout randomization switched off, which is a lab curiosity, not an attack. Hacktron writes that Opus 4.8 then “struggled across several sessions to produce a working exploit with ASLR enabled.” Opus 5 shipped that same day. Within three hours it produced a working ARM64 exploit, and after the team asked it to port the work to the x86-64 and jemalloc configuration Discourse actually runs, they confirmed remote code execution by 06:00 UTC on July 25.
Same researchers. Same bug. Same target. The variable that flipped a dead exploit into a live one was the model version, and the gap between those two versions is measured in hours, not quarters. That is the datapoint, and it is a capability-jump measurement the industry almost never gets this cleanly.
AI is removing that protection by turning more of this scarce expertise into compute.
Hacktron AI, on why exploit development used to be scarce
Now the second buried thing, and the one I would act on today. The AI got them code execution on a Discourse forum. It did not get them into OpenAI. What did that was an OpenAI single sign-on misconfiguration that let control of the forum environment become access to the ChatGPT and Codex accounts of people who had authenticated through it. From there they used a compromised employee’s Codex account, connected to OpenAI’s GitHub organization, to open pull request #1186742 in the internal openai/openai repository. The whole path took under 72 hours.
The underlying flaw was mundane. Discourse’s FastImage does not support HEIF, so uploads fell through to ImageMagick and hit a heap overflow in libheif 1.19.7, tracked as CVE-2026-32882. Discourse published its advisory on July 28 with a CVSS score of 8.8. OpenAI confirmed its own fix at 22:49 UTC on July 25, roughly fourteen hours after disclosure, and paid $6,500 on September 1. The entire two-month project cost the team under $3,000 in tokens.
Verdict: matters. The industry is going to spend this week arguing about whether frontier labs should sell exploit-capable models, and that argument is not actionable for you. This is: a forum account became a source code account because one token carried more scope than the forum needed. I wrote two weeks ago that the model was the cheapest part of the breach, and this is the cleanest illustration of it yet. Go look at what your agent’s OAuth tokens can reach when the agent is doing something trivial. Every lab shipped the capability jump. Nobody shipped the scope fix, because the scope fix is yours.
OpenAI Put 230 Million URLs Behind Astra for Law
OpenAI launched Astra for Law on September 17, a GPT-6 Astra configuration sitting on a purpose-built legal search index of more than 230 million URLs covering US case law, statutes, regulations, court rules and administrative decisions, with sources added daily. Much of the case law comes from the Free Law Project, the nonprofit behind CourtListener, and OpenAI says the collection reaches more than 99.9% of published US precedential case law. It ships with 26 partner plugins, Zero Data Retention controls built with Latham & Watkins, and forward-deployed engineers embedded at firms including Sullivan and Cromwell and Cooley.
The number I care about is 54%. That is the share of research questions the configuration passed on Vals AI’s Legal Research Bench, against 38.7% for the same model with ordinary web search. A 15-point jump from retrieval alone is a real result, and 54% is still a failing grade in any other context.
Verdict: matters, with the benchmark caveat I keep repeating. The lesson is not that OpenAI won legal. It is that the index was the product and the model was the commodity. OpenAI did not fine-tune its way here, it went and built a corpus nobody else had. If you are trying to verticalize anything, that is the shape of the work, and it is much less glamorous than a model announcement. Also note the pattern from the 38.8% private-code benchmark result last week: vendor-run benchmarks flatter the vendor, and this one is OpenAI reporting its own evaluation.
The Sora 2 Videos API Shuts Off on September 24
Five days out, and it is on OpenAI’s own deprecations page: the Videos API and the Sora 2 model aliases and snapshots are removed from the API on September 24. OpenAI gave notice back on March 24, so this is the 180-day policy working exactly as written. The replacement column is empty.
Two more behind it. The gpt-5.4-cyber model goes on October 1, with gpt-5.6-cyber as the migration path. Then October 23 takes a large legacy sweep including the remaining gpt-3.5-turbo and gpt-4 variants and the o1 family, pointed at gpt-5.6-sol, gpt-5.6-terra and gpt-5.6-luna.
Verdict: breaks your stack. Nothing subtle here. If you have video generation wired into a product, you have this weekend.
Agent Security Raised $435 Million While 88% of Agent Projects Never Ship
Venture investors put $435 million into 12 financings for enterprise AI agent companies between April and September, and nine of those rounds went specifically to agent security and governance, according to reporting on the five-month tally. Alice raised $140 million led by Apax Digital and is approaching $100 million in ARR. Zenity took $125 million in a Norwest-led Series C. Those two alone are $265 million, or 61% of the total.
Verdict: marketing, wrapped around a number that matters. The funding is the press release. The statistic underneath it is the story: IDC and Lenovo research puts 88% of enterprises with agent initiatives as never shipping to production, and Gartner expects more than 40% of agentic AI projects to be cancelled by the end of 2027. Read those two facts together and the category looks less like a growth market and more like a market selling seatbelts to people whose cars never left the driveway. I do not think the governance tools are worthless, and the Hacktron story above is a decent argument for exactly this category. I think a control plane bought before you have a single agent in production is shelfware with a Series C behind it. Ship one agent, find out what it actually touches, then buy the thing that constrains it.
Claude for Small Business Added 43 Workflows and 27 Connectors
Anthropic expanded Claude for Small Business on September 15 with 43 workflows and 27 new integrations covering Shopify, Salesforce, Xero, Gusto, Square, Stripe, Zoom and Zapier, running inside Claude Cowork. Anthropic says the product has been installed more than 900,000 times since it launched in May.
Verdict: marketing, with one detail worth stealing. A count of 43 workflows is a catalog number, not a capability, and catalog numbers are how every integration platform has ever marketed itself. The 900,000 installs figure is real and genuinely large. But the design decision I would copy is this one: every workflow starts in approval mode, where Claude drafts and stages and nothing sends, posts or pays until a human says yes. That is the correct default, it is the opposite of the autonomy story the rest of the industry is selling, and after reading the Hacktron writeup this morning I am more convinced it is right, not less.
Where This Leaves You
The through-line today is scope. Opus 5 cracked a memory bug in three hours and that is genuinely new, but the reason it turned into a monorepo pull request is that a token could reach further than its job required. The agent security round and Anthropic’s approval-mode default are two different answers to that same problem, one sold to you for a Series C and one shipped as a checkbox. The Sora 2 shutoff is the only item on this list with a date attached, and it is Thursday.