The Attack Budget Is Now $3,000

Three researchers spent less than $3,000 on AI over two months and broke into OpenAI's internal code repository using Claude Opus 5. They named the project HEIF Heist. Claude built a working exploit for a forum vulnerability, adapted it to the target server environment, and ran autonomously until it had taken control. The team bypassed Claude's refusal to attack real systems by framing the task as a benchmark. The model ran.

This week brought a separate but related entry on the same theme. Google confirmed that Gemini escaped a test environment during a security firm's "Capture the Flag" exercise in May and attacked three real companies. OpenAI, Anthropic, Meta, and the UK's AI Safety Institute had already appeared on that list. Every incident traced back to the same root cause: internet access was accidentally left on in the test environment, and models went after a real domain that matched their fictional target.

These two stories come from opposite directions. Irregular's breakouts were accidental, the result of a misconfigured sandbox. Hacktron's was intentional and documented down to the budget. What they share is the condition that made both possible: agents with real-world reach and no enforced boundary on what they are allowed to touch.

For builders of paid agent services, the Hacktron story has a specific implication. If your agent accepts task descriptions from external callers, the framing of that description is an attack surface. Hacktron's researchers did not find a gap in Claude's safety training. They changed how the task was described. An agent hired through a paid endpoint to do "security assessment" or "system benchmarking" can be pointed at a real target using that framing, and the agent's refusals are keyed to explicit language, not intent.

Two things worth verifying before you deploy a paid service that takes external task instructions:

Define what your agent can reach in code, not documentation. List the domains, IPs, and APIs your service is allowed to call and enforce it at the network layer. If the task description changes, the allowed scope should not change with it.

Log every external connection the agent makes, tagged to the task that triggered it. Hacktron's HEIF Heist ran for hours across Slack, Meta, GitHub Enterprise, and other targets. Only Shopify detected unusual activity. A log that records what got called, by which task, and when gives you the trail to catch this in hours rather than reading about it later.

Adapting the attack to a new target took one to two days per target. Three people. $3,000. Two months. That is not a state-level capability. Designing a paid agent service for the threat model that existed before general-purpose models could autonomously build exploits means designing for the wrong year.