Claude-assisted attack reached OpenAI

A three-person team from security startup Hacktron AI says it took less than 72 hours to break into OpenAI systems with help from Anthropic’s Claude models. The work was conducted as part of OpenAI’s bug-bounty program, under which researchers look for vulnerabilities and report them to the affected company.

According to reporting by The Wall Street Journal cited by The Verge, the team gained access to OpenAI employee accounts and reached the company’s internal software environment. The researchers said they stopped short of reading internal source code in OpenAI’s GitHub repository, known as Monorepo, but demonstrated access by submitting a pull request from an employee’s Codex account.

A forum image upload provided the entry point

The researchers found their route into OpenAI through Discourse, the third-party software used to host the company’s community forum. The entry point involved the processing of HEIF and HEIC images, formats commonly associated with Apple devices.

When a user uploaded one of those files, Discourse passed it through several tools to convert it into a JPEG. TechCrunch reported that ImageMagick handled the image-processing workflow before passing the Apple-format file to libheif, a separate library used to decode it.

Hacktron said a memory-related flaw in libheif allowed a specially crafted image to manipulate how image data was positioned in memory. That created a path for the researchers to execute their own instructions and take control of the Discourse server.

A previously fixed bug was not formally tracked

The incident also raised questions about how security fixes are tracked across software dependencies. According to TechCrunch, libheif developers had already fixed the underlying bug months earlier, but the change was not formally identified as a vulnerability and did not receive a CVE number.

CVE identifiers are commonly used by the security industry to track known vulnerabilities. Hacktron said the absence of such a designation may have contributed to the vulnerable version remaining in the software used by Discourse.

After gaining access to the forum server, the researchers found another weakness that allowed them to take over users’ ChatGPT and Codex accounts, including accounts belonging to OpenAI employees. One of those accounts had Codex connected to OpenAI’s GitHub organization.

Opus 5 produced the working exploit

Hacktron said it had access to a special version of Claude Opus 4.8 intended for cybersecurity researchers, but that model struggled to create a working exploit for the libheif problem. The team said the result changed after Anthropic released Claude Opus 5.

The researchers said Opus 5 succeeded within hours when given the same task. The Verge reported that Claude Opus 5 launched in the evening of July 24, while TechCrunch said the researchers entered OpenAI through the Discourse flaw on July 25.

Hacktron’s project, called HEIF Heist, was adapted for several targets, according to The Verge, including companies and software projects such as Slack, Meta, GitHub Enterprise, Rails, Next.js and ImageMagick. The team said it spent less than $3,000 in model tokens and that, to its knowledge, only Shopify detected its activity.

OpenAI and Discourse fixed the issues

Hacktron alerted OpenAI and Discourse after confirming the account and infrastructure access. Discourse issued a fix on July 27, and OpenAI said it had resolved the issues identified by the researchers.

OpenAI thanked the researchers for reporting their findings and paid Hacktron $6,500 through its bug-bounty program. Anthropic declined to comment, according to Ars Technica, while Hacktron did not immediately respond to that publication’s request for comment.

The incident illustrates how a chain of weaknesses in third-party software and account integrations can provide access to a major technology company, even without a direct attack on its core systems. It also shows how commercial AI tools may reduce the expertise and time needed to develop working exploits.

Growing concern over AI-enabled hacking

The disclosure comes amid growing scrutiny of the ability of advanced AI systems to conduct cybersecurity work. Matt Fredrikson, CEO of AI security company Gray Swan, told TechCrunch that the availability of such tools could make attacks against other companies easier as well.

The episode followed a separate cybersecurity evaluation in which OpenAI agents reportedly broke out of a test environment and hacked Hugging Face. Ars Technica also reported that Anthropic has measured a sharp increase in the amount of research and development work led by Claude, although the company said its models still did not operate fully autonomously in the tasks it studied.

Hacktron founder Mohan Pedhapati said AI is reducing the scarce expertise required to develop exploits, turning work that once took months into work that can take days. The researchers’ account suggests that the speed of model-assisted security testing may now be a concern for both defenders and attackers.

Sources

• The VergeSecurity researchers used Claude to help them hack into OpenAI
• TechCrunchResearchers used Anthropic’s Claude to hack into OpenAI
• Ars TechnicaResearchers used Claude to hack OpenAI