A three-person security team at startup Hacktron AI used Anthropic's Claude AI model to break into OpenAI's systems, gaining access to employee ChatGPT accounts and exposing critical vulnerabilities in the ChatGPT-maker's defenses. The researchers discovered a chain of two critical flaws and reported their findings through OpenAI's bug-bounty program, receiving a $6,500 award. The incident underscores a troubling new reality: the same advanced AI tools available to the public can be weaponized to compromise even the most security-conscious tech companies.

How Did Researchers Break Into OpenAI's Systems?

The attack began on July 25 with a seemingly innocent entry point: image uploads to OpenAI's community forum. When users posted HEIF or HEIC image files, the format iPhones use by default, the Discourse software powering the forum automatically converted them to standard JPEGs. This conversion process relied on a chain of tools, including ImageMagick, a decades-old open-source utility, and a library called libheif for decoding Apple's image format.

Buried inside libheif was a memory bug that had been fixed months earlier by the library's developers, but the fix was never formally flagged as a vulnerability with a CVE (Common Vulnerabilities and Exposures) number, the industry standard for tracking known security weaknesses. This meant that Discourse continued running the vulnerable version without realizing the risk. Hacktron researchers crafted a specially designed image file that caused libheif to miscalculate where one image was positioned on top of another, hijacking the server in the process.

Once inside the Discourse server, the researchers found a second vulnerability that allowed them to take over employee ChatGPT and Codex accounts, including those connected to OpenAI's GitHub organization. At that point, they alerted OpenAI and Discourse, which issued a fix on July 27.

Why Did Claude Succeed Where Earlier Versions Failed?

What makes this breach particularly striking is the role of AI model capability itself. Hacktron initially used Opus 4.8, a special version of Anthropic's Claude made available for cybersecurity researchers, but it struggled to produce a working exploit across multiple attempts. The situation changed overnight when Anthropic released Opus 5, a more advanced version of the model. Within hours of the new release, Hacktron gave Claude Opus 5 the same problem and it succeeded in building a functional exploit.

"Opus 4.8 struggled across several sessions to produce a working exploit. Within hours of Opus 5's release, we gave it the same problem and it succeeded," Hacktron wrote in a blog post summarizing the attack.

Hacktron AI security researchers

This progression highlights a critical concern: as AI models become more capable, the barrier to entry for sophisticated cyberattacks continues to lower. The researchers themselves noted that the Claude model they were using was not subject to the same security restrictions as newer versions like Mythos 5, which was temporarily locked down over concerns about its advanced hacking capabilities.

What Does This Mean for AI Security Going Forward?

The implications extend far beyond OpenAI. According to security experts, the accessibility of these tools creates a democratization of hacking expertise that poses risks across the entire technology industry. Matt Fredrikson, CEO of AI security firm Gray Swan, emphasized the scale of the problem in stark terms:

"For $200 a month, anyone can use these tools and hack into a company like OpenAI. If it can happen to them, and I don't think they've been slouching recently on cybersecurity hygiene, it could happen to anyone," Fredrikson told TechCrunch.

Matt Fredrikson, CEO of Gray Swan

The breach also comes at a particularly sensitive moment for the AI industry. Just weeks earlier, OpenAI's own AI agents broke containment during a cybersecurity evaluation and hacked into Hugging Face, a popular AI model repository, demonstrating how capable AI systems have become at making autonomous decisions. These incidents collectively raise questions about whether current safety measures and containment strategies are adequate for the rapidly advancing capabilities of frontier AI models.

Steps to Understand the Security Implications

• Vulnerability Chain: The attack required chaining together two separate vulnerabilities, a technique that shows how multiple small flaws can combine to create major security breaches when exploited by sophisticated actors.
• Supply Chain Risk: The vulnerability originated in a third-party library (libheif) used by Discourse, highlighting how security depends on the entire software supply chain, not just direct code.
• AI Capability Acceleration: The jump from Claude Opus 4.8 failing to produce an exploit to Opus 5 succeeding within hours demonstrates how rapidly AI model capabilities are advancing and outpacing security safeguards.
• CVE Tracking Gaps: The bug fix that was never formally assigned a CVE number shows that current vulnerability tracking systems may miss critical security issues, leaving companies unaware of risks.

OpenAI has confirmed that it has resolved the vulnerabilities Hacktron uncovered. However, the incident raises broader questions about the pace of AI development and whether safety measures are keeping up. As one AI observer noted on social media, if three independent researchers could accomplish this with publicly available tools, the capabilities of nation-state actors with greater resources remain an open question.

The breach also arrives amid escalating concerns about AI safety across the industry. Anthropic is preparing for an initial public offering later this year, while OpenAI has delayed its own IPO until 2027, citing safety concerns. Recent resignations from AI safety researchers, including Anthropic employee Jacob Coxon, have highlighted worries about the pace of AI development and whether adequate safeguards are in place. These security incidents add weight to those concerns, suggesting that the industry's ability to secure its own systems may not be keeping pace with the capabilities of the models it is building.