In a twist on the strange new landscape of AI security, independent security researchers used Anthropic’s Claude to break into OpenAI and expose cracks in the ChatGPT creator’s defenses, the Wall Street Journal reported Thursday evening.
A three-person security team from startup Hacktron AI carried out the attack as part of OpenAI’s bug bounty program. Hacktron reported its findings to OpenAI, which awarded the startup a $6,500 award. The team chained together two critical vulnerabilities to gain access to multiple OpenAI employee ChatGPT accounts, allowing them to compromise the company’s software.
OpenAI says it has solved the problems revealed by Hacktron, which coincidentally comes at a time when top AI companies are under increasing pressure over safety.
The incident comes weeks after OpenAI’s own AI agent broke containment and hacked Hugging Face during a cybersecurity assessment, demonstrating how AI models are increasingly capable of making their own decisions. We also highlight how off-the-shelf technology can be used to discover vulnerabilities even in the most advanced enterprise infrastructure.
“For $200 a month, anyone can use these tools to hack into companies like OpenAI,” Matt Fredrikson, CEO of AI security company Gray Swan, told TechCrunch. “If it can happen to them, and I doubt they’re cutting corners with their cybersecurity hygiene these days, it can happen to anyone.”
Or, as one AI expert pointed out on social media, “[HackTron]used Opus 5 to successfully hack…The question is, if these three can pull this off, what can nation-states do?”
Researchers discovered a compromise to OpenAI on July 25th via a flaw in Discourse, the third-party software that powers OpenAI’s community forums.
According to a blog published by the researchers, the entry point was a common image upload. When users posted HEIF or HEIC image files (the format that iPhones use by default) to OpenAI’s community forum, Discourse ran them through a series of behind-the-scenes tools and converted them to standard JPEGs. The first one I looked at was ImageMagick, a decades-old open source utility used to resize images. ImageMagick’s regular toolkit can’t handle Apple’s format, so I passed the file to another library called libheif to do the decoding.
A memory bug was embedded within libheif, exposing a path for attackers to sneak in their own instructions. In this case, it turned out that feeding the library with specially created images caused the position of one image to be miscalculated on top of another, enough to hijack the server.
What may be off-putting to the cybersecurity community is that the bug was already fixed by libheif’s developers several months ago. However, this fix was never formally reported as a vulnerability, meaning it did not receive a CVE (Common Vulnerability and Exposure) number, the industry standard method of tracking known security weaknesses. Hacktron said this could explain why the software Discourse was using was still running a vulnerable version.
Notably, the researchers said the Claude model they were using, a special version of Opus 4.8 released for cybersecurity researchers, was initially unable to build a working exploit. That changed overnight when Anthropic released Opus 5.
“Opus 4.8 took me several sessions to create a working exploit,” Hacktron wrote in a blog post. “Within hours of Opus 5’s release, we successfully presented the same problem.”
Researchers discovered another flaw that allowed them to take over ChatGPT and Codex accounts of users, including those belonging to OpenAI employees, once on the Discourse server.
“We then took over the account of an OpenAI employee whose Codex was connected to OpenAI’s Github organization,” Hacktron wrote in a synopsis of the event.
At this point, the researchers alerted OpenAI and Discourse, who issued a fix on July 27th.
The incident shines a spotlight on where the line is drawn in model functionality. The final bug-free version, Claude Opus 5, faces no security export restrictions, unlike the newer version of Mythos 5, which was temporarily locked down over concerns about its advanced hacking capabilities.
These are just closed models. Openweight models are increasingly coming to the forefront of cyber capabilities. For example, the AI safety nonprofit SaferAI recently found that Chinese company Z.ai’s GLM-5.2 was just a few months behind OpenAI’s GPT-5.5 and Anthropic’s Claude Opus 4.7.
As Hacktron founder Mohan Pedhapati said on X, “AI is reducing the amount of rarefied expertise needed to develop exploits. What used to take months now takes days.”
If you make a purchase through links in our articles, we may earn a small commission. This does not affect editorial independence.
