Viral AI News (Sep 19): OpenAI Hack, AI Posters & Laya
Viral AI news September 19: three researchers breached OpenAI for $6,500 using Claude Opus 5, plus a 630-point Hacker News debate on AI posters and Laya.
The most talked about AI story of the last 24 hours is not a model release. It is three people with a subscription, a rival lab's newest model, and a $6,500 payout from the company they broke into. That story leads today's viral AI news, alongside a Hacker News argument about AI-generated posters that pulled 630 points, a claim that GPT-6 Astra cracked a century-old radio cipher, and an open source clone of Jev that hit the front page in four hours.
The OpenAI hack that cost less than a laptop
Hacktron AI is a three-person Indian cybersecurity startup. Its team, Harsh Jaiswal, Mohan Pedhapati, and Rahul Maini, chained a libheif image-processing bug in OpenAI's Discourse-based community forum with a single sign-on flaw at auth.openai.com, hijacked an OpenAI employee's account, and reached the company's private Monorepo GitHub organisation. To prove access they opened a pull request inside it, then reported the flaws. Source: Cryptopolitan
The numbers are what made it spread. The team spent under $3,000 in model tokens. OpenAI paid a $6,500 bounty. Claude Opus 4.8 failed to build a working exploit once address space layout randomisation was switched on, and Claude Opus 5, released the evening of July 24, produced a working ARM64 exploit within three hours. Source: The Tech Portal
OpenAI said the researchers found one issue in a third-party service and one in OpenAI's own identity infrastructure, both now resolved, with the SSO flaw fixed within 14 hours and affected sessions revoked. Discourse issued an advisory scoring the image bug 8.8 on the CVSS scale. Hacktron says the same libheif research extends to Slack, Meta, Zoom, Shopify, and GitHub Enterprise, and that only the OpenAI timeline is fully confirmed so far.
The honest read is that this is impressive research and a terrifying cost curve at once. A three-person team with a monthly model subscription now reaches systems that used to require a funded red team. The security industry should read it as a price signal.
AI posters: 630 points and 377 comments
A blog post arguing that AI-generated event posters do not have to look terrible reached 630 points and 377 comments on Hacker News, the day's most engaged thread. Source: Hacker News
The substance behind the noise is craft. The author walks through why most AI posters fail, which comes down to typography, layout hierarchy, and treating the model as a layout engine rather than a designer. The thread split between people who found the examples genuinely good and people who argued the bar for AI output has quietly collapsed.
GPT-6 Astra and a WWI cipher
A community write-up claims GPT-6 Astra solved a World War I German radio cipher that had resisted conventional cryptanalysis. The post hit 230 points and 121 comments in eight hours. Source: Hacker News
Label this one community-sourced. The claim appears in an individual blog post, not in a peer-reviewed paper or a Tier 1 outlet, and the thread contains scepticism about how much of the work was the model versus the prompt author. It is the second cipher story to trend here in a week.
Laya, an open source Jev, hits the front page
Laya is an open source reimplementation of Jev, the agent tool that trended here on September 16 when it shipped free tokens. The launch hit 384 points and 83 comments within four hours. Source: Hacker News
The pattern is familiar and worth naming. A commercial agent tool gets traction, and within days an open source clone appears on the front page with a fraction of the marketing. The comments focused on what the clone does differently, not on cost, which suggests the audience treats it as a real alternative. Source: ConvaI Innovations
Quick Comparison
| Trend | What Went Viral | Engagement Metric | Verdict |
|---|---|---|---|
| Hacktron breach | OpenAI hacked for $6,500 | Broke via WSJ, all-day social spread | Verified, and genuinely alarming |
| AI posters post | AI graphics can look good | 630 points, 377 comments | Real craft argument |
| GPT-6 Astra cipher | WWI radio cipher solved | 230 points, 121 comments | Community-sourced, unverified |
| Laya | Open source Jev clone | 384 points, 83 comments | Plausible alternative |
Frequently Asked Questions
What is the viral AI news today?
The viral AI story today is three researchers at Hacktron AI breaching OpenAI's internal systems and private code repository for under $3,000 in model tokens. They chained a libheif image bug in OpenAI's Discourse forum with a single sign-on flaw, filed a pull request inside OpenAI's Monorepo as proof, and collected a $6,500 bounty.
How did Hacktron AI hack OpenAI so cheaply?
Hacktron AI combined a known library vulnerability with a single sign-on flaw, then used Anthropic's Claude Opus 5 to write the exploit. Opus 4.8 failed against address space layout randomisation. Opus 5, released July 24, produced a working ARM64 exploit within three hours. Total model spend stayed under $3,000 and OpenAI fixed the SSO flaw within 14 hours.
Is the GPT-6 Astra cipher claim verified?
No, the claim that GPT-6 Astra solved a World War I German radio cipher is unverified and community-sourced. It comes from an individual blog post with no peer review or Tier 1 coverage, and the Hacker News thread contains scepticism about how much credit belongs to the model versus the person writing the prompt.
Related: Viral AI News (Sep 18) covered the Claude hack that started this thread. Browse the archive under the Viral tag.
Building an AI agent, automation, or backend workflow? AsaanKaroobar builds custom AI solutions, apps, and digital experiences. Get in touch →
Related reading
Deeper context from the archive on the companies and technologies in this story:
