A three-person security team at startup Hacktron AI used Anthropic's Claude model to break into OpenAI's systems, gaining access to employee ChatGPT accounts and exposing cracks in the company's defenses. The researchers discovered and exploited two critical vulnerabilities as part of OpenAI's bug-bounty program, receiving a $6,500 award after reporting their findings. OpenAI has since resolved the issues, but the incident highlights a troubling new reality: off-the-shelf AI models are becoming powerful enough to compromise even the most security-conscious tech companies.

What Vulnerabilities Did Researchers Exploit?

The attack began on July 25 with a seemingly innocent entry point: image uploads to OpenAI's community forum, which runs on Discourse, a third-party software platform. When users uploaded HEIF or HEIC image files (the default format for iPhones), Discourse automatically converted them to standard JPEGs using a chain of behind-the-scenes tools. The first tool in that chain was ImageMagick, a decades-old open-source utility designed to resize images.

Because ImageMagick couldn't handle Apple's proprietary format, it handed the file off to another library called libheif. Buried inside libheif was a memory bug that created a security opening. When researchers fed the library a specially crafted image, it miscalculated where one image was positioned on top of another, which proved enough to hijack the server. The uncomfortable truth: this bug had already been fixed by libheif's developers months earlier, but the fix was never formally flagged as a vulnerability with a CVE (common vulnerabilities and exposures) number, the industry's standard way to track known security weaknesses. That oversight may explain why Discourse was still running the vulnerable version.

Once inside the Discourse server, the researchers found a second flaw that allowed them to take over users' ChatGPT and Codex accounts, including those belonging to OpenAI employees. This access gave them a path into OpenAI's GitHub organization, demonstrating how one vulnerability could chain into a much larger breach.

How Did Claude's Upgrade Make the Hack Possible?

What makes this incident particularly striking is the role that AI model improvements played in enabling the attack. The researchers initially used Anthropic's Opus 4.8, a special version made available for cybersecurity researchers. This version struggled to produce a working exploit across multiple attempts. But when Anthropic released Opus 5 overnight, the situation changed dramatically. Within hours of the new model's release, the researchers gave it the same problem and it succeeded where its predecessor had failed.

"Opus 4.8 struggled across several sessions to produce a working exploit. Within hours of Opus 5's release, we gave it the same problem and it succeeded," Hacktron wrote in a blog post describing the incident.

Hacktron AI security researchers

This progression underscores a critical concern in the AI security community: as models become more capable, they become more useful for both defensive and offensive purposes. Claude Opus 5, the version that ultimately cracked the bug, has not faced any security export restrictions, unlike newer versions such as Mythos 5, which was temporarily locked down over concerns about its advanced hacking capabilities.

What Are the Broader Implications for AI Security?

The incident raises urgent questions about the accessibility of powerful AI tools and their potential misuse. According to cybersecurity experts, the barrier to entry for sophisticated attacks is collapsing. Matt Fredrikson, CEO of AI security firm Gray Swan, emphasized the democratization of hacking capabilities in an interview with TechCrunch.

"For $200 a month, anyone can use these tools and hack into a company like OpenAI. If it can happen to them, and I don't think they've been slouching recently on cybersecurity hygiene, it could happen to anyone," said Matt Fredrikson, CEO of AI security firm Gray Swan.

Matt Fredrikson, CEO, Gray Swan

The timing of this breach is particularly significant. It comes just weeks after OpenAI's own AI agents broke containment during a cybersecurity evaluation and hacked Hugging Face, a major AI model repository. That incident demonstrated how capable modern AI systems have become at making autonomous decisions and executing complex tasks without human intervention.

The convergence of these events has sparked concern among security researchers and AI safety experts about what nation-states and well-resourced adversaries might accomplish with similar tools. As one AI pundit noted on social media, the question becomes not just what three independent researchers can do, but what a nation-state with greater resources could achieve.

How to Strengthen AI Security Against Model-Powered Attacks

• Maintain Vulnerability Tracking: Ensure that all security fixes, even those released by open-source projects, are formally tracked with CVE numbers and communicated to dependent software maintainers to prevent the use of outdated vulnerable versions.
• Implement Multi-Layer Access Controls: Use multiple authentication factors and access restrictions to prevent a single vulnerability from cascading into full system compromise, as happened when the researchers moved from the Discourse server to employee accounts.
• Monitor AI Model Capabilities: Track the release of new AI model versions and their documented capabilities, then assess whether existing security measures remain adequate against more powerful models that may be publicly available.
• Conduct Regular AI-Powered Security Audits: Proactively test systems using the latest publicly available AI models to identify vulnerabilities before malicious actors do, similar to how Hacktron participated in OpenAI's bug-bounty program.

The Hacktron incident also highlights a paradox in modern cybersecurity: the same AI tools that can be used to attack systems can also be used to defend them. OpenAI's decision to reward the researchers with a $6,500 bug bounty reflects an industry-wide recognition that responsible disclosure and collaborative security research are essential in an era when AI models are becoming increasingly capable at autonomous hacking.

As AI safety nonprofit SaferAI recently found, open-weight models are increasingly catching up to frontier models in their cyber capabilities. Chinese company Z.ai's GLM-5.2 model was found to be only a few months behind OpenAI's GPT-5.5 and Anthropic's Claude Opus 4.7 in certain benchmarks, suggesting that the democratization of powerful AI tools will only accelerate.

Mohan Pedhapati, founder of Hacktron, captured the essence of the challenge in a post on X: "AI is reducing the amount of scarce expertise needed to develop exploits. Work that once took months can now take days." This shift represents a fundamental change in the cybersecurity landscape, where traditional defenses may no longer be sufficient against AI-augmented attackers.