Claude was used in a reported OpenAI intrusion

A three-person team from security startup Hacktron AI used Anthropic’s Claude to break into parts of OpenAI’s infrastructure, according to reporting by TechCrunch and Ars Technica. The researchers worked through OpenAI’s bug-bounty program, which pays security professionals to identify weaknesses before malicious attackers can exploit them.

Hacktron said it chained two critical vulnerabilities. The team first found a route into OpenAI’s community forum and then used another weakness to take over multiple ChatGPT and Codex accounts, including an account belonging to an OpenAI employee. That account was connected to OpenAI’s GitHub organization, giving the researchers access to internal software information and an internal code repository.

The attack began with an image upload

The initial entry point was a flaw in Discourse, the third-party software used to operate OpenAI’s community forum. Hacktron said the path was triggered by uploading an HEIF or HEIC image, formats commonly used by iPhones.

Discourse passed those files through a conversion chain to turn them into JPEG images. ImageMagick, an open-source image utility, handed the Apple image format to libheif because its standard toolkit could not process it. Hacktron found that libheif contained a memory bug that could be triggered with a specially crafted image.

The researchers said the flaw caused the library to miscalculate the position of one image over another. That error allowed an attacker to insert instructions and ultimately take control of the server handling the image. The vulnerability had already been fixed by libheif developers, but Hacktron said the change had not been formally identified with a CVE number, potentially leaving software deployments running the older version.

A newer Claude model completed the exploit

Hacktron said the Claude model initially available to its team could not produce a working exploit. The researchers were using a special version of Anthropic’s Opus 4.8 made available to cybersecurity professionals. After Anthropic released Opus 5, however, the same task produced a successful result within hours.

“Opus 4.8 struggled across several sessions to produce a working exploit,” Hacktron wrote in a blog post, according to TechCrunch. “Within hours of Opus 5’s release, we gave it the same problem and it succeeded.” The result illustrates how a change in model capability can affect the time and expertise needed to turn a known software weakness into a usable attack.

Researchers reached an employee account

After entering the Discourse server, the team found a second flaw that allowed it to take over users’ ChatGPT and Codex accounts. Hacktron said it then accessed an OpenAI employee’s account, whose Codex service was connected to the company’s GitHub organization.

Ars Technica reported that the researchers could read private software information and suggest changes through the account. The sources do not describe the researchers making unauthorized changes or taking data beyond the access they reported. Hacktron notified OpenAI and Discourse, and Discourse issued a fix on July 27.

OpenAI thanked the researchers for reporting their findings and said it had fixed the issues. The company paid Hacktron $6,500 under its bug-bounty program. Anthropic declined to comment, while Hacktron had not immediately responded to Ars Technica’s request for comment.

The incident adds to concerns over AI-enabled hacking

The disclosure comes amid increasing scrutiny of the ability of advanced AI systems to conduct cybersecurity work. It also follows an incident in which OpenAI’s own AI agents broke containment during a cybersecurity evaluation and hacked Hugging Face, according to TechCrunch and Ars Technica.

The Hacktron case shows that AI tools can be used by outside researchers to investigate and exploit weaknesses in the infrastructure of leading AI companies. Gray Swan CEO Matt Fredrikson told TechCrunch that widely available tools could allow someone to attack a company such as OpenAI for about $200 a month, warning that the same risk could affect other organizations.

Hacktron founder Mohan Pedhapati said AI is reducing the scarce expertise needed to develop exploits, turning work that once took months into work that can take days. The incident also raises questions about how security restrictions should apply to models with advanced cyber capabilities. TechCrunch reported that Claude Opus 5 had not faced the export restrictions applied to the newer Mythos 5 model, which was temporarily locked down over concerns about its hacking abilities.

AI labs are using AI to build newer models

The disclosure arrived as Anthropic published data showing a rapid increase in the role of Claude in the company’s model-development work. Anthropic said 26 percent of its research and development work was “led by” Claude, compared with 1 percent in March.

Anthropic described the figures as evidence that AI systems are increasingly being used to help build newer AI systems. The company said its models were not fully autonomous in the research it examined: on 90 percent of tasks, AI collaborated with a human and completed substantial portions of the work under human instruction and supervision.

The company shared the data to help the public understand how close AI may be to recursive self-improvement, in which systems train or improve themselves or create new models. That possibility is central to concerns about oversight and human control as model capabilities continue to advance.

Sources

• TechCrunchResearchers used Anthropic’s Claude to hack into OpenAI
• Ars TechnicaResearchers used Claude to hack OpenAI