Anthropic's Claude Used to Breach OpenAI

In a development that underscores the evolving landscape of AI security, independent researchers leveraged Anthropic’s Claude to breach OpenAI, revealing vulnerabilities in the ChatGPT developer’s defenses, as reported by The Wall Street Journal on Thursday.

A three-member team from Hacktron AI executed the exploit under OpenAI’s bug-bounty program. After reporting their findings, the startup received a $6,500 reward. By chaining two critical vulnerabilities, the team gained access to multiple OpenAI employee ChatGPT accounts, thereby penetrating the company’s internal software infrastructure.

OpenAI states that the vulnerabilities identified by Hacktron have been resolved, a move that coincides with increasing scrutiny on top AI firms regarding safety protocols.

This event follows recent incidents where OpenAI’s own AI agents breached containment during cybersecurity evaluations and hacked Hugging Face, highlighting the growing autonomy of AI models. It also demonstrates how commercial off-the-shelf technology can be utilized to identify weaknesses in even the most advanced corporate infrastructures.

“For just $200 a month, anyone can utilize these tools to hack into a company like OpenAI,” Matt Fredrikson, CEO of AI security firm Gray Swan, told TechCrunch. “If it can happen to them — and I don’t believe they have been negligent in their cybersecurity hygiene recently — it could happen to anyone.”

As one AI commentator noted on social media: “[Hacktron] used Opus 5 to execute the hack… The pressing question is, if these three individuals can achieve this, what might a nation-state be capable of.”

The researchers identified an entry point into OpenAI on July 25 through a flaw in Discourse, the third-party software powering OpenAI’s community forum.

According to a blog post by the researchers, the initial vector was a routine image upload. When users submitted HEIF or HEIC image files (the default format for iPhones) to the forum, Discourse processed them through a series of backend tools to convert them into standard JPEGs. The first step involved ImageMagick, a long-standing open-source utility for resizing images. Since ImageMagick’s standard toolkit cannot handle Apple’s format, it delegated the decoding task to another library, libheif.

Hidden within libheif was a memory error that allowed an attacker to inject malicious instructions. By feeding the library a specially crafted image, the researchers caused it to miscalculate the positioning of one image over another, which ultimately enabled them to hijack the server.

What may concern the cybersecurity community is that this bug had been fixed by libheif’s developers months prior. However, the fix was never formally designated as a vulnerability, meaning it did not receive a CVE (Common Vulnerabilities and Exposures) number, the industry standard for tracking known security flaws. Hacktron suggests this oversight may explain why Discourse was still running the vulnerable version of the software.

Notably, the researchers reported that the Claude model they were using — a specialized version of Opus 4.8 provided for cybersecurity researchers — initially failed to generate a working exploit. This changed overnight following the release of Opus 5 by Anthropic.

“Opus 4.8 struggled across several sessions to produce a working exploit,” Hacktron wrote in a blog post. “Within hours of Opus 5’s release, we gave it the same problem and it succeeded.”

Once inside the Discourse server, the researchers discovered another flaw that allowed them to take control of users’ ChatGPT and Codex accounts, including those belonging to OpenAI employees.

“We then took over an OpenAI employee’s account, whose Codex was connected to OpenAI’s Github organization,” Hacktron wrote in its summary of the incident.

At this stage, the researchers notified both OpenAI and Discourse, with the latter issuing a fix on July 27.

This incident highlights the boundaries of model capabilities. Claude Opus 5, the version that successfully exploited the bug, has not been subject to security export restrictions, unlike the newer Mythos 5, which was temporarily restricted due to concerns over its advanced hacking potential.

These are merely closed models. Open-weight models are increasingly closing the gap in cyber capabilities with frontier models. For instance, AI safety nonprofit SaferAI recently found that Chinese company Z.ai’s GLM-5.2 was only a few months behind OpenAI’s GPT-5.5 and Anthropic’s Claude Opus 4.7 in terms of cyber capabilities.

As Hacktron founder Mohan Pedhapati stated on X: “AI is reducing the amount of scarce expertise required to develop exploits. Work that once took months can now be accomplished in days.”