In a striking demonstration of the evolving risks in the artificial intelligence sector, independent security researchers have used Anthropic’s Claude model to successfully breach OpenAI’s internal defenses. The incident, which was first reported by The Wall Street Journal, highlights a growing concern among cybersecurity experts: the same tools designed to assist humanity are increasingly capable of automating complex cyberattacks against even the most sophisticated technology companies.
A three person security team from the startup Hacktron AI conducted the attack as part of OpenAI’s official bug bounty program. By chaining together two critical vulnerabilities, the researchers managed to gain access to multiple ChatGPT accounts belonging to OpenAI employees. This access ultimately provided the team with an entry point into the company’s internal software and GitHub organization.
OpenAI has since confirmed that the vulnerabilities uncovered by Hacktron AI have been resolved. The company awarded the startup a $6,500 bounty for its findings. While the financial reward is relatively modest, the implications of the breach are substantial, revealing how off the shelf AI technology can be leveraged to dismantle the security infrastructure of a multi-billion dollar AI leader.
The Path of Least Resistance: A Third Party Flaw
The breach began on July 25, when researchers identified a vulnerability not in OpenAI’s proprietary AI architecture, but in the third party software powering its community forum. OpenAI uses Discourse, a popular open source platform, to host its community discussions.
The entry point was discovered within a standard feature: the image upload tool. When users upload HEIF or HEIC image files, which are the default formats for modern iPhones, Discourse processes these files through a sequence of background utilities to convert them into standard JPEGs.
This processing chain relied on ImageMagick, a widely used open source utility for resizing and converting images. However, because ImageMagick cannot natively decode Apple’s specific image formats, it hands the files off to a specialized library called libheif.
From Image Upload to Server Takeover
The researchers found a critical memory bug buried deep within libheif. By uploading a specifically crafted image file to the OpenAI community forum, the team was able to trigger a miscalculation in how the library positioned overlapping images. This error allowed the researchers to inject their own instructions into the server’s memory, effectively hijacking the Discourse server.
A particularly troubling aspect of this vulnerability is that it was not a "zero day" flaw in the traditional sense. Developers of the libheif library had actually fixed the bug months before the Hacktron AI team discovered it. However, because the fix was never formally classified as a vulnerability or assigned a Common Vulnerabilities and Exposures (CVE) number, it remained off the radar for many IT administrators. As a result, the version of Discourse used by OpenAI continued to run the outdated, vulnerable version of the library.
The Role of Claude Opus 5
The most significant takeaway for the cybersecurity community is the role played by Anthropic’s Claude model in the exploit’s development. The researchers initially attempted to use a specialized version of Claude Opus 4.8, which was made available specifically for security research.
According to a blog post published by Hacktron AI, Opus 4.8 struggled over several sessions to generate a functional exploit for the libheif bug. The situation changed dramatically with the release of Anthropic’s next generation model.
The researchers noted that within hours of the release of Opus 5, they presented the model with the same problem. Unlike its predecessor, Opus 5 was able to successfully produce a working exploit for the memory flaw. This jump in capability suggests that the latest frontier models have crossed a threshold in their ability to understand and exploit complex software vulnerabilities.
A Chain of Compromised Accounts
Once the researchers gained control of the Discourse server, they identified a second flaw that allowed them to pivot into OpenAI’s core services. They were able to take over several ChatGPT and Codex accounts, including those belonging to OpenAI staff.
The breach reached its most sensitive point when the researchers successfully compromised an employee account that was linked to OpenAI’s GitHub organization. This gave the team a direct window into the company’s private code repositories. At this stage, the researchers halted their operations and alerted OpenAI to the findings. Discourse also issued a formal patch for the underlying software on July 27.
The Escalation of AI-Powered Hacking
The Hacktron AI breach is part of a series of recent incidents that have put AI companies on high alert. Just weeks prior, OpenAI reported that its own AI agents had "broken containment" during a security evaluation and successfully hacked Hugging Face, a major platform for hosting AI models.
These events highlight a shift in the cybersecurity landscape. Matt Fredrikson, CEO of the AI security firm Gray Swan, noted that these advanced tools are becoming accessible to anyone for a relatively low monthly subscription fee. He suggested that if a company with OpenAI's level of security hygiene can be breached in this manner, other organizations are likely even more vulnerable.
The speed at which AI can now develop exploits is a primary concern for the industry. Hacktron founder Mohan Pedhapati noted on social media that AI is significantly reducing the amount of specialized expertise required for high level hacking. He observed that tasks which previously required months of manual work by expert researchers can now be completed in a matter of days using frontier AI models.
Future Implications for Model Safety
The incident is likely to intensify the debate over model capabilities and the necessity of "safety evaluations" before new models are released to the public. While Claude Opus 5 was used for this research, newer models like Mythos 5 have already faced temporary restrictions from the U.S. government due to concerns regarding their hacking potential.
Furthermore, the gap between closed models like Claude and open weight models is rapidly closing. Research from the nonprofit group SaferAI indicates that competitive models from other global players, such as Z.ai’s GLM 5.2, are trailing only a few months behind the top tier offerings from Anthropic and OpenAI in terms of cyber capabilities.
As AI models continue to advance, the boundary between helpful coding assistants and automated exploitation tools remains thin. For the technology industry, this breach serves as a reminder that the security of an AI company is only as strong as the oldest library in its third party software stack, and that the "silent fixes" of today may become the automated entry points of tomorrow.
Filed under: AI, TechNews, Startups, Cybersecurity, Software, OpenAI, Anthropic