Security researchers used Claude to breach OpenAI's internal systems

Security researchers at a small startup called Hacktron AI used Anthropic’s Claude to break into OpenAI’s internal systems, chaining two vulnerabilities to gain access to employee ChatGPT accounts, the Wall Street Journal reported Thursday evening.

The three-person Hacktron team carried out the intrusion through OpenAI’s bug-bounty program, a system that pays outside researchers for finding security flaws. OpenAI awarded the team $6,500 for the discovery and says it has fixed the issues. The breach came despite what one security executive described as OpenAI’s otherwise strong recent record on cybersecurity hygiene.

The researchers found their way in on July 25 through Discourse, third-party software that runs OpenAI’s community forum. When users uploaded HEIC image files, the format iPhones save photos in by default, Discourse passed them through ImageMagick, a decades-old open-source tool for resizing images. ImageMagick could not read that format itself, so it handed the file to libheif, a separate decoding library. A memory bug inside libheif let a specially crafted image trick the server into misplacing image layers, opening a path for attackers to run their own commands. Libheif’s developers had already patched that bug months earlier, but the fix was never assigned a CVE, the tracking number the security industry uses to flag known vulnerabilities. Hacktron says that gap likely explains why Discourse was still running the vulnerable version.

Claude needed a newer model to finish the job

Hacktron said the version of Claude it used at first, a variant of Opus 4.8 built for security researchers, could not produce a working exploit despite repeated attempts. Anthropic then released Opus 5, and within hours the same problem produced a successful attack, according to Hacktron’s own writeup. Once inside the Discourse server, the researchers found a second flaw that let them take over ChatGPT and Codex accounts, including one belonging to an OpenAI employee whose Codex access was tied to the company’s GitHub organization. Hacktron alerted OpenAI and Discourse, which released a fix on July 27.

Matt Fredrikson, chief executive of AI security firm Gray Swan, told TechCrunch that a $200-a-month subscription is now enough for someone to break into a company like OpenAI. Hacktron founder Mohan Pedhapati wrote on social media that AI is cutting the expertise needed to build exploits, turning work that once took months into a matter of days.

The episode also points to uneven rules on which AI models face security restrictions. Opus 5 has faced no export limits, while Anthropic’s newer Mythos 5 was briefly locked down over concerns about its hacking ability. Open-weight models are narrowing the gap as well: the nonprofit SaferAI recently found that Z.ai’s GLM-5.2 trailed OpenAI’s GPT-5.5 and Anthropic’s Claude Opus 4.7 by only a few months. What happens next depends on whether OpenAI’s fix holds and whether patched libraries like libheif’s start getting tracked with CVE numbers, closing the kind of gap that let this bug go unnoticed for months.